{ "info": { "author": "", "author_email": "", "bugtrack_url": null, "classifiers": [ "Environment :: Web Environment", "Framework :: Django", "Framework :: Django :: 1.10", "Framework :: Django :: 1.11", "Framework :: Django :: 1.8", "Framework :: Django :: 1.9", "Intended Audience :: Developers", "License :: OSI Approved :: BSD License", "Operating System :: OS Independent", "Programming Language :: Python", "Programming Language :: Python :: 2", "Programming Language :: Python :: 2.7", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3.6", "Topic :: Security", "Topic :: Software Development :: Libraries :: Python Modules" ], "description": "# Django-Security\n\n[](https://travis-ci.org/sdelements/django-security)\n\nThis package offers a number of models, views, middlewares and forms to facilitate security hardening of Django applications.\n\n# Full documentation\n\nAutomatically generated documentation of `django-security` is available on Read The Docs:\n\n* [Django-security documentation](http://django-security.readthedocs.org/en/latest/)\n\n# Requirements\n\n* Python >= 2.7\n* Django >= 1.8\n\nFor Django < 1.8 use django-security==0.9.4.\n\nNote: For versions prior to 0.10.0, `datetime` objects were being added to the session and required Django's PickleSerializer for (de)serializing. This has now been changed so that the strings of these `datetime`s are being stored instead. If you are still using PickleSerializer for this reason, we suggest switching to Django's default JSONSerializer (default since Django 1.6) for better security.\n\n\n# Installation\n\nInstall from Python packages repository:\n\n pip install django-security\n\nIf you prefer the latest development version, install from\n[django-security](https://github.com/sdelements/django-security) repository on GitHub:\n\n git clone https://github.com/sdelements/django-security.git\n cd django-security\n sudo python setup.py install\n\nAdding to Django application's `settings.py` file:\n\n INSTALLED_APPS = (\n ...\n 'security',\n ...\n )\n\nPre-Django 1.10, middleware modules can be added to `MIDDLEWARE_CLASSES` list in settings file:\n\n MIDDLEWARE_CLASSES = (\n ...\n 'security.middleware.DoNotTrackMiddleware',\n 'security.middleware.ContentNoSniff',\n 'security.middleware.XssProtectMiddleware',\n 'security.middleware.XFrameOptionsMiddleware',\n )\n\nAfter Django 1.10, middleware modules can be added to `MIDDLEWARE` list in settings file:\n\n MIDDLEWARE = (\n ...\n 'security.middleware.DoNotTrackMiddleware',\n 'security.middleware.ContentNoSniff',\n 'security.middleware.XssProtectMiddleware',\n 'security.middleware.XFrameOptionsMiddleware',\n )\n\n\n\nUnlike the modules listed above, some other modules **require** configuration settings,\nfully described in [django-security documentation](http://django-security.readthedocs.org/en/latest/).\nBrief description is provided below.\n\n## Middleware\n\nProvided middleware modules will modify web application's output and input and in most cases requires no\nor minimum configuration.\n\n
| Middleware\n | Description\n | Configuration\n |
|---|---|---|
| ClearSiteDataMiddleware\n | Send Clear-Site-Data header in HTTP response for any page that has been whitelisted. Recommended,.\n | Required.\n\n |
| ContentNoSniff\n | Disable possibly insecure autodetection of MIME types in browsers. Recommended.\n | None.\n\n |
| ContentSecurityPolicyMiddleware\n | Send Content Security Policy (CSP) header in HTTP response. Recommended, requires careful tuning.\n | Required.\n\n |
| DoNotTrackMiddleware\n | Read user browser's DoNotTrack preference and pass it to application. Recommended, requires implementation in views and templates.\n | None.\n\n |
| LoginRequiredMiddleware\n | Requires a user to be authenticated to view any page on the site that hasn't been white listed.\n | Required.\n\n |
| MandatoryPasswordChangeMiddleware\n | Redirects any request from an authenticated user to the password change form if that user's password has expired.\n | Required.\n\n |
| NoConfidentialCachingMiddleware\n | Adds No-Cache and No-Store headers to confidential pages.\n | Required.\n\n |
| P3PPolicyMiddleware\n | Adds the HTTP header attribute specifying compact P3P policy.\n | Required.\n\n |
| SessionExpiryPolicyMiddleware\n | Expire sessions on browser close, and on expiry times stored in the cookie itself.\n | Required.\n\n |
| StrictTransportSecurityMiddleware\n | Enforce SSL/TLS connection and disable plaintext fall-back. Recommended for SSL/TLS sites.\n | Optional.\n\n |
| XFrameOptionsMiddleware\n | Disable framing of the website, mitigating Clickjacking attacks. Recommended.\n | Optional.\n\n |
| XssProtectMiddleware\n | Enforce browser's Cross Site Scripting protection. Recommended.\n | None.\n\n |