Ticket #16248: 16248-security.diff
| File 16248-security.diff, 2.6 KB (added by , 13 years ago) |
|---|
-
docs/topics/security.txt
13 13 .. highlightlang:: html+django 14 14 15 15 XSS attacks allow a user to inject client side scripts into the 16 browsers of other users. This is usually ach eived by storing the malicious16 browsers of other users. This is usually achieved by storing the malicious 17 17 scripts to the database where it will be retrieved and displayed to other users 18 18 or to get users to click a link containing variables containing scripts that 19 19 will be rendered by the user's browser. However, XSS attacks can originate … … 25 25 26 26 Django templates :ref:`escape specific characters <automatic-html-escaping>` 27 27 which are particularly dangerous to HTML. While this protects users from most 28 malic ations input, it is not entirely foolproof. For example, it will not28 malicious input, it is not entirely foolproof. For example, it will not 29 29 protect the following: 30 30 31 31 .. code-block:: html+django … … 97 97 the form of the 98 98 :mod:`X-Frame-Options middleware <django.middleware.clickjacking.XFrameOptionsMiddleware>` 99 99 which in a supporting browser can prevent a site from being rendered inside 100 ofa frame. It is possible to disable the protection on a per view basis100 a frame. It is possible to disable the protection on a per view basis 101 101 or to configure the exact header value sent. 102 102 103 103 The middleware is strongly recommended for any site that does not need to have … … 139 139 :setting:`CSRF_COOKIE_SECURE` settings to ``True``. This instructs the browser 140 140 to only send these cookies over HTTPS connections. Note that this will mean 141 141 that sessions will not work over HTTP, and the CSRF protection will prevent 142 any dataPOST data being accepted over HTTP (which will be fine if you are142 any POST data being accepted over HTTP (which will be fine if you are 143 143 redirecting all HTTP traffic to HTTPS). 144 144 145 145 .. _additional-security-topics: … … 157 157 brute-force attacks against the authentication system, you may consider 158 158 deploying a Django plugin or web server module to throttle these requests. 159 159 * If your site accepts file uploads, it is strongly advised that you limit 160 the these uploads in your web server configuration to a reasonable160 these uploads in your web server configuration to a reasonable 161 161 size in order to prevent denial of service (DOS) attacks. In Apache, this 162 162 can be easily set using the LimitRequestBody_ directive. 163 163 * Keep your :setting:`SECRET_KEY` a secret.