Why Django security matters - See It in Action

Why Django Security Matters

📖 Scenario: You are building a simple Django web application that handles user data. Security is very important to protect users and your site from attacks.

🎯 Goal: Learn why Django security features matter by setting up a basic Django project with security settings and a simple view that uses Django's security protections.

📋 What You'll Learn

Create a Django project with a settings file

Add a secret key variable in settings

Use Django's built-in CSRF protection in a view

Enable debug mode off for production safety

💡 Why This Matters

🌍 Real World

Web applications need security to protect user data and prevent attacks like CSRF and data leaks.

💼 Career

Understanding Django security basics is essential for web developers to build safe and trusted applications.

1

Create Django project settings with secret key

Create a Django settings file with a variable SECRET_KEY set to the exact string 'django-insecure-12345'.

Django

# Your code here
# Define SECRET_KEY = 'django-insecure-12345'

Need a hint?

The secret key is a long string that Django uses to keep data safe. Use the exact string given.

2

Add debug mode configuration

Add a variable DEBUG and set it to False to simulate production security settings.

Django

SECRET_KEY = 'django-insecure-12345'
# Your code here
# Set DEBUG = False

Need a hint?

Debug mode should be off in production to avoid showing sensitive info.

3

Create a simple Django view with CSRF protection

Write a Django view function called submit_form that uses the decorator @csrf_protect from django.views.decorators.csrf.

Django

SECRET_KEY = 'django-insecure-12345'
DEBUG = False

# Your code here
# Import csrf_protect and create submit_form view with @csrf_protect

Need a hint?

CSRF protection helps prevent malicious form submissions. Use the decorator exactly as shown.

4

Complete settings with allowed hosts

Add a variable ALLOWED_HOSTS set to a list containing the string 'localhost' to restrict which hosts can serve the app.

Django

SECRET_KEY = 'django-insecure-12345'
DEBUG = False
ALLOWED_HOSTS = []

from django.http import HttpResponse
from django.views.decorators.csrf import csrf_protect

@csrf_protect
def submit_form(request):
    return HttpResponse('Form submitted safely')

# Your code here
# Set ALLOWED_HOSTS = ['localhost']

Need a hint?

Allowed hosts prevent your app from being served on unknown domains. Use the exact list with 'localhost'.