OWASP Django Security Cheat Sheets

1. General Recommendations

   DEBUG, SECRET_KEY, updates and middleware.

2. Authentication

   Django auth, password validators and hashers.

3. Key Management

   SECRET_KEY handling and rotation.

4. Headers

   Security headers and SecurityMiddleware.

5. Content Security Policy

   CSP in Django.

6. Cookies

   Session and CSRF cookie flags.

7. CSRF

   Django CsrfViewMiddleware usage.

8. XSS

   Template auto-escaping and unsafe filters.

9. HTTPS

   SECURE_SSL_REDIRECT and HSTS settings.

10. Admin Panel URL

    Hardening the Django admin.

11. check --deploy

    Using manage.py check --deploy.

12. Django REST Framework

    Throttling, permissions and serializer safety in DRF.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.

• OWASP Authorization Cheat Sheets
• OWASP CI/CD and Supply Chain Cheat Sheets
• OWASP Cryptographic Storage Cheat Sheets
• OWASP CSRF Prevention Cheat Sheet
• OWASP Dependency-Check
• OWASP Deserialization Cheat Sheet
• OWASP Docker Security Cheat Sheet
• OWASP File Upload Cheat Sheet
• OWASP GraphQL Cheat Sheet
• OWASP Injection Prevention Cheat Sheets
• OWASP Input Validation Cheat Sheets
• OWASP Kubernetes Security Cheat Sheet