Django Security

This is your production Django security checklist in one place. It covers the settings you need to lock down before deployment (HSTS, secure cookies, ALLOWED_HOSTS), authentication patterns like custom user models and Argon2 password hashing, and authorization with permission mixins and RBAC. The SQL injection section shows safe ORM usage versus dangerous raw queries, and the XSS part walks through template escaping and the escapejs filter. Use this when you're hardening a Django app for production, setting up auth, or doing a security review. It's comprehensive without being theoretical, just the code you actually need to write.

skills.sh installs: 6.1K
GitHub stars: 300.3K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/ecc --skill django-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Django Security Best Practices

Comprehensive security guidelines for Django applications to protect against common vulnerabilities.

When to Activate

Setting up Django authentication and authorization
Implementing user permissions and roles
Configuring production security settings
Reviewing Django application for security issues
Deploying Django applications to production

Core Security Settings

Production Settings Configuration

# settings/production.py
import os

DEBUG = False  # CRITICAL: Never use True in production

ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',')

# Security headers
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SECURE_HSTS_SECONDS = 31536000  # 1 year
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
SECURE_CONTENT_TYPE_NOSNIFF = True
X_FRAME_OPTIONS = 'DENY'

# HTTPS and Cookies
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = 'Lax'
CSRF_COOKIE_SAMESITE = 'Lax'

SKILL.md on GitHub