Security Misconfiguration in Django

Remediating security misconfigurations in Django requires systematic changes to your settings and configuration. Start with environment-specific settings to ensure development and production configurations remain separate.

# settings/base.py - common settings
import os
from pathlib import Path

BASE_DIR = Path(__file__).resolve().parent.parent
SECRET_KEY = os.getenv('DJANGO_SECRET_KEY')
DEBUG = os.getenv('DEBUG', 'false').lower() == 'true'

# settings/production.py - production-specific
from .base import *
DEBUG = False

# Security settings
SECURE_SSL_REDIRECT = True
SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_BROWSER_XSS_FILTER = True

# Session security
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = 'Strict'
CSRF_COOKIE_SECURE = True
CSRF_COOKIE_HTTPONLY = True

# Host configuration
ALLOWED_HOSTS = ['api.example.com', 'www.example.com']

# Middleware ordering
MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

# Django admin security
ADMIN_ENABLED = os.getenv('ADMIN_ENABLED', 'false').lower() == 'true'
if not ADMIN_ENABLED:
    from django.urls import path
    from django.views.decorators.csrf import csrf_exempt
    
    @csrf_exempt
def disabled_admin_view(request):
        return HttpResponse('Admin disabled', status=404)
    
    urlpatterns = [path('admin/', disabled_admin_view)]

Implement environment variable validation to prevent misconfiguration. Use Django-environ or similar libraries to enforce required settings.

# settings/production.py - validation
import environ

env = environ.Env(
    DEBUG=(bool, False),
    SECRET_KEY=(str, None),
    DATABASE_URL=(str, None),
    ALLOWED_HOSTS=(list, ['localhost']),
)

# Raise exception if required variables are missing
env.read_env('.env')

# Validate critical settings
if not env('SECRET_KEY'):
    raise ImproperlyConfigured('SECRET_KEY is required')

# Database configuration with validation
db_url = env('DATABASE_URL')
if not db_url:
    raise ImproperlyConfigured('DATABASE_URL is required')

DATABASES = {
    'default': env.db()
}

Implement automated security checks in your Django application using middleware that validates security configurations at startup.

# middleware/security_check.py
from django.core.exceptions import MiddlewareNotUsed

class SecurityConfigurationCheckMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response
        
        # Perform security checks at startup
        self.check_security_config()
    
    def __call__(self, request):
        return self.get_response(request)
    
    def check_security_config(self):
        from django.conf import settings
        import warnings
        
        # Check for debug mode in production
        if settings.DEBUG and not settings.ALLOWED_HOSTS == ['localhost']:
            warnings.warn('
                DEBUG mode is enabled in production! 
                This exposes sensitive information to attackers.
            ')
        
        # Check session security
        if not getattr(settings, 'SESSION_COOKIE_SECURE', False):
            warnings.warn('
                SESSION_COOKIE_SECURE is not enabled! 
                Session cookies can be hijacked over HTTP.
            ')
        
        # Check middleware ordering
        middleware = [m.__name__ for m in settings.MIDDLEWARE]
        if 'SecurityMiddleware' not in middleware or middleware.index('SecurityMiddleware') != 0:
            warnings.warn('
                SecurityMiddleware should be first in the middleware stack.
            ')

Integrate middleBrick into your Django development workflow to catch security misconfigurations before they reach production. Use the CLI tool in your CI/CD pipeline to automatically scan your Django application.

# Scan Django application with middleBrick
middlebrick scan https://api.example.com/django-endpoint \
  --output json \
  --fail-on-severity critical

Configure middleBrick as a GitHub Action to scan your Django application on every pull request, ensuring security misconfigurations are caught early.

# .github/workflows/security-scan.yml
name: Security Scan
on: [pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run middleBrick Scan
        run: |
          npm install -g middlebrick
          middlebrick scan ${{ secrets.API_URL }} \
            --output json \
            --fail-on-severity critical
      - name: Upload Results
        uses: actions/upload-artifact@v3
        with:
          name: security-scan-results
          path: middlebrick-report.json