Security Best Practices

A new Django project already blocks four common attacks, yet it is not ready for the public internet. The protections against forged form submissions, injected scripts, injected SQL and hidden frames work from the first runserver. The settings that protect a live site, such as HTTPS and a secret key that nobody else knows, need values only you can supply. The first half of this lesson shows how each built-in protection works and how code can switch it off. The second half configures the blog's production settings until check --deploy has nothing left to report.