Django 安全最佳实践

import os
from pathlib import Path

# 生产环境必须设置为 False
DEBUG = False

# 允许的主机列表
ALLOWED_HOSTS = [
    'yourdomain.com',
    'www.yourdomain.com',
    '127.0.0.1',  # 仅在开发时使用
]

# 安全密钥 - 生产环境使用环境变量
SECRET_KEY = os.environ.get('SECRET_KEY', 'fallback-secret-key-for-dev-only')

# HTTPS 设置
SECURE_SSL_REDIRECT = True  # 强制 HTTPS
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
SESSION_COOKIE_SECURE = True  # 仅通过 HTTPS 传输会话 Cookie
CSRF_COOKIE_SECURE = True     # 仅通过 HTTPS 传输 CSRF Cookie

# 安全头设置
SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True
X_FRAME_OPTIONS = 'DENY'  # 防止点击劫持

# HSTS 设置 (谨慎使用)
SECURE_HSTS_SECONDS = 31536000  # 1年
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True

import os

# 环境检测
ENVIRONMENT = os.environ.get('DJANGO_ENV', 'development')

if ENVIRONMENT == 'production':
    DEBUG = False
    ALLOWED_HOSTS = ['yourdomain.com', 'www.yourdomain.com']
    SECURE_SSL_REDIRECT = True
    # 其他生产环境安全设置...
else:
    DEBUG = True
    ALLOWED_HOSTS = ['localhost', '127.0.0.1']
    # 开发环境设置...

{# 自动转义 - 安全 #}
<p>{{ user_input }}</p>
{# 输出: <script>alert('XSS')</script> #}

{# 手动关闭转义 - 危险！ #}
<p>{{ user_input|safe }}</p>
{# 输出: <script>alert('XSS')</script> #}

{# 条件性标记安全 #}
<p>{{ user_input|escape }}</p>
{# 显式转义 #}

{# 安全的HTML内容 #}
{% autoescape off %}
    <p>{{ trusted_html_content }}</p>
{% endautoescape %}

# 安装: pip install django-bleach

# forms.py
from django import forms
import bleach

class CommentForm(forms.Form):
    content = forms.CharField(widget=forms.Textarea)

    def clean_content(self):
        content = self.cleaned_data['content']
        # 清理 HTML，只允许安全的标签和属性
        cleaned_content = bleach.clean(
            content,
            tags=['p', 'br', 'strong', 'em', 'a'],
            attributes={'a': ['href', 'title']},
            strip=True
        )
        return cleaned_content

# 安装
pip install django-csp

# settings.py
MIDDLEWARE = [
    # ...
    'csp.middleware.CSPMiddleware',
]

# CSP 配置
CSP_DEFAULT_SRC = ["'self'"]
CSP_SCRIPT_SRC = ["'self'", "https://cdn.example.com"]
CSP_STYLE_SRC = ["'self'", "'unsafe-inline'"]
CSP_IMG_SRC = ["'self'", "data:", "https:"]
CSP_FONT_SRC = ["'self'"]

# settings.py
AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
        'OPTIONS': {
            'min_length': 8,
        }
    },
    {
        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
    },
]

# 密码哈希设置
PASSWORD_HASHERS = [
    'django.contrib.auth.hashers.Argon2PasswordHasher',
    'django.contrib.auth.hashers.PBKDF2PasswordHasher',
    'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
]

from django.contrib.auth.decorators import login_required, permission_required
from django.contrib.auth.mixins import LoginRequiredMixin, PermissionRequiredMixin

# 要求登录
@login_required
def profile_view(request):
    return render(request, 'profile.html')

# 要求特定权限
@permission_required('app.view_sensitive_data')
def sensitive_view(request):
    return render(request, 'sensitive.html')

# 基于类的视图权限
class AdminView(LoginRequiredMixin, PermissionRequiredMixin, View):
    permission_required = 'app.admin_access'
    login_url = '/login/'
    redirect_field_name = 'next'

# settings.py
# 会话设置
SESSION_COOKIE_AGE = 1209600  # 2周，默认
SESSION_COOKIE_SECURE = True   # 仅 HTTPS
SESSION_COOKIE_HTTPONLY = True # 防止 XSS 读取
SESSION_COOKIE_SAMESITE = 'Lax' # CSRF 防护

# 会话引擎（推荐使用数据库或缓存）
SESSION_ENGINE = 'django.contrib.sessions.backends.db'
# 或者使用缓存
# SESSION_ENGINE = 'django.contrib.sessions.backends.cache'

# 会话过期设置
SESSION_EXPIRE_AT_BROWSER_CLOSE = False  # 持久会话
SESSION_SAVE_EVERY_REQUEST = True        # 每次请求保存会话

# 检查安全配置
python manage.py check --deploy

# 检查依赖漏洞
pip audit
pip list --outdated

# 使用 safety 检查已知漏洞
pip install safety
safety check

# 使用 bandit 进行代码安全扫描
pip install bandit
bandit -r myproject/

# 使用 django-extensions 进行安全检查
python manage.py validate_templates
python manage.py show_urls

# requirements-dev.txt
django-debug-toolbar==3.2.4
django-extensions==3.1.3
bandit==1.7.0
safety==1.10.3
pytest-bandit==0.6.1

# 在 CI/CD 中添加安全扫描
# .github/workflows/security.yml
name: Security Scan
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Run Bandit
        run: |
          pip install bandit
          bandit -r myproject/ -f html -o bandit_report.html
      - name: Run Safety
        run: |
          pip install safety
          safety check --json > safety_report.json