How to Prevent XSS in Django: Secure Your Web App

To prevent XSS in Django, always use Django's template system which auto-escapes variables by default and avoid marking user input as safe. Additionally, validate and sanitize any user input before rendering it in templates or storing it.

Why This Happens

XSS happens when an attacker injects malicious scripts into web pages viewed by other users. In Django, this can occur if you directly output user input in templates without escaping it, allowing harmful JavaScript to run in users' browsers.

django

{% raw %}
<!-- Broken template example -->
<p>User comment: {{ comment|safe }}</p>
{% endraw %}

Output

<p>User comment: <script>alert('XSS')</script></p> <!-- This runs the alert script -->

The Fix

Django templates escape variables automatically, so do not mark user input as safe unless you are sure it is clean. Use the default {{ comment }} syntax without |safe. Also, sanitize inputs if you allow HTML.

django

{% raw %}
<!-- Fixed template example -->
<p>User comment: {{ comment }}</p>
{% endraw %}

Output

<p>User comment: &lt;script&gt;alert('XSS')&lt;/script&gt;</p> <!-- Script tags are escaped and shown as text -->

Prevention

Always use Django's template system for rendering HTML to benefit from automatic escaping. Avoid using |safe filter on user input. Validate and sanitize inputs on forms or APIs. Use libraries like bleach if you need to allow some HTML safely. Keep Django updated to get security patches.

Related Errors

Other common security issues include SQL Injection and CSRF attacks. Django provides built-in protections like ORM parameterization and CSRF tokens. Always use Django forms and middleware to handle these risks.

Key Takeaways

Django templates auto-escape variables to prevent XSS by default.

Never mark user input as safe unless it is fully sanitized.

Validate and sanitize all user inputs before rendering or storing.

Use libraries like bleach to safely allow limited HTML if needed.

Keep Django and dependencies updated for security fixes.