Code-Memo

Deployment Checklist: python manage.py check --deploy

When deploying a Django application, it’s essential to make sure that your application is secure and optimized for a production environment. Django provides a management command python manage.py check --deploy to help identify common deployment issues.

1. DEBUG Setting

• Ensure DEBUG is set to False:
  • In your settings.py, make sure the DEBUG setting is False. This disables debug mode, which can expose sensitive information.

    DEBUG = False
    

2. ALLOWED_HOSTS

• Configure ALLOWED_HOSTS:
  • Define the list of host/domain names that this Django site can serve. This is a security measure to prevent HTTP Host header attacks.

    ALLOWED_HOSTS = ['yourdomain.com', 'www.yourdomain.com']
    

3. SECRET_KEY

• Use a Secure SECRET_KEY:
  • Ensure your SECRET_KEY is a long, random, and unique string, and never expose it in your source code or repository.

    SECRET_KEY = os.getenv('DJANGO_SECRET_KEY', 'your-secret-key')
    

4. Database Security

• Use a Secure Database Password:
  • Make sure your database password is strong and secure. Avoid using default passwords.
• Restrict Database Access:
  • Configure your database to only allow access from your application server’s IP address.

5. CSRF and Session Security

• Ensure CSRF and Session Security:
  • Make sure CSRF protection is enabled by including 'django.middleware.csrf.CsrfViewMiddleware' in your MIDDLEWARE setting.
  • Use secure cookies for session storage.

    CSRF_COOKIE_SECURE = True
    SESSION_COOKIE_SECURE = True
    

6. SSL/HTTPS

• Use HTTPS:
  • Redirect HTTP traffic to HTTPS by using SECURE_SSL_REDIRECT.

    SECURE_SSL_REDIRECT = True
    

• Set SECURE_HSTS_SECONDS:
  • This instructs the browser to only communicate with the server over HTTPS.

    SECURE_HSTS_SECONDS = 3600  # 1 hour
    SECURE_HSTS_INCLUDE_SUBDOMAINS = True
    SECURE_HSTS_PRELOAD = True
    

7. Static and Media Files

• Serve Static and Media Files Securely:
  • Use a dedicated server or cloud storage service (like AWS S3) to serve static and media files.

    STATIC_ROOT = '/path/to/static/'
    MEDIA_ROOT = '/path/to/media/'
    

8. Security Middleware

• Add Security Middleware:
  • Ensure that you have the security middleware included in your MIDDLEWARE setting.

    MIDDLEWARE = [
      'django.middleware.security.SecurityMiddleware',
      # Other middleware
    ]
    

9. X-Content-Type-Options Header

• Set SECURE_CONTENT_TYPE_NOSNIFF:
  • Prevent the browser from guessing the content type.

    SECURE_CONTENT_TYPE_NOSNIFF = True
    

10. Content Security Policy

• Implement a Content Security Policy (CSP):
  • Protect against cross-site scripting (XSS) and other code injection attacks.
  • Use a library like django-csp to implement CSP.

11. Session Cookie Attributes

• Set Secure Attributes on Session Cookies:

  SESSION_COOKIE_HTTPONLY = True
  SESSION_COOKIE_SECURE = True
  

12. Check for Known Vulnerabilities

• Run Security Checks:
  • Use tools like Bandit or Safety to check for known security vulnerabilities in your code and dependencies.

    pip install bandit safety
    bandit -r your_project/
    safety check
    

Additional Tips

• Regularly Update Dependencies:
  • Keep your dependencies up to date to ensure you have the latest security patches.
• Monitoring and Logging:
  • Implement logging and monitoring to keep track of your application’s health and performance.
• Backup Strategy:
  • Ensure you have a reliable backup and recovery strategy in place.
• Load Testing:
  • Perform load testing to ensure your application can handle the expected traffic.
• Automate Your Deployments:
  • Use CI/CD tools like GitHub Actions, Jenkins, or GitLab CI to automate your deployment process.