skills.rest
clfigueiredo
clfigueiredoCOMMUNITY
Explore all skills by this author →
GitHub

django-security

Implements Django security practices for authentication, CSRF, XSS, and SQL injection prevention.

5|15|Updated Jul 8, 2026
Search Tags:#security#authentication#sql injection#python#django#csrf#xss prevention
One-click install
npx skills add https://github.com/clfigueiredo/hermes-infra-skills --skill django-security-clfigueiredo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: django-security
Source: https://github.com/clfigueiredo/hermes-infra-skills/tree/main/.hermes/skills/curso-hermes/django-security
Command: npx skills add https://github.com/clfigueiredo/hermes-infra-skills --skill django-security-clfigueiredo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Django applications are vulnerable to common web attacks like SQL injection, XSS, CSRF, and weak authentication when developers misconfigure settings or write unsafe code. This Skill provides concrete, production-ready security patterns and configurations to harden Django applications against these threats. ## Core Features & Use Cases - Production Security Settings: Enforces HTTPS, HSTS, secure cookies, security headers, and environment-based secret management with DEBUG disabled. - Authentication & Authorization: Covers custom user models, Argon2 password hashing, RBAC, permission mixins, and DRF permission classes like IsOwnerOrReadOnly. - Attack Prevention: Provides safe patterns for ORM queries (SQL injection), template escaping (XSS), CSRF tokens, file upload validation via magic bytes, and API rate limiting. - Use Case: Before deploying a Django app to production, use this Skill to audit your settings.py, add CSP headers, configure throttling, and validate that file uploads check MIME types against extensions. ## Quick Start Review my Django project's settings and views for security issues and apply the production hardening configurations.

Frequently Asked Questions about django-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure a Django application for production deployment?▼

Set DEBUG to False, enable SECURE_SSL_REDIRECT, HSTS, secure cookies, and X_FRAME_OPTIONS. Store SECRET_KEY in environment variables, enable all password validators, and configure ALLOWED_HOSTS from environment settings.

How to prevent SQL injection in Django queries?▼

Use the Django ORM which automatically escapes parameters, or pass parameters as lists to raw() queries. Never interpolate user input directly into SQL strings with f-strings or concatenation.

What password hasher should Django use for stronger security?▼

Use Argon2PasswordHasher as the first entry in PASSWORD_HASHERS, with PBKDF2 as fallback. Django defaults to PBKDF2, but Argon2 provides stronger resistance against brute-force attacks.

Does Django protect against XSS attacks by default?▼

Yes, Django templates auto-escape variables by default. Avoid using the safe filter or mark_safe with user input, and use escapejs for JavaScript contexts and format_html for HTML generation.

How do I validate file uploads in Django securely?▼

Validate file type using magic bytes with python-magic or the filetype package, cross-check the extension against the detected MIME type, and enforce size limits through model field validators.

How to add rate limiting to Django REST Framework APIs?▼

Configure DEFAULT_THROTTLE_CLASSES with AnonRateThrottle and UserRateThrottle in REST_FRAMEWORK settings, and define rates like 100/day for anonymous users. Create custom throttle classes for burst and sustained limits.

Related Skills

Explore More Software Engineering Skills→
AbdullahmohammadarefAbdullahmohammadaref

django-security

Harden Django authentication, authorization, CSRF protection, and deployment settings.

Community
Advanced
ssrxsssrxs

django-security

Configure Django security settings for authentication, CSRF, XSS, and SQL injection protection.

Community
Advanced
AeonDaveAeonDave
15

set

Automate spear-phishing, credential harvesting, and payload delivery for penetration testing.

Community
Advanced
ialaeialae

api-design-skill

Guide Python REST API design across Flask, FastAPI, and Django REST Framework.

Community
Advanced