How secure is Django

Question

A client of mine asked me this question. I am not even sure what to reply ? I am no security expert, just a web dev. What can must I say ?

Answer 1

By default, Django prevents most common security mistakes:

• XSS (cross-site scripting) protection — Django template system by default escapes variables, unless they are explicitly marked as safe.
• CSRF (cross site request forgery) protection — easy to turn on globally, guarantees that forms (POST requests) are sent from your own site.
• SQL injection protection — Django uses built-in ORM, thus there is no risk of SQL injection (raw queries are possible, but by no means something that a beginner would need to use).

Additional security features:

• Clickjacking protection — Django can detect when the content is requested from unauthorized iframe
• Safe password hash — Django by default uses PBKDF2, another option is bcrypt. Both are resilient to usage of rainbow tables (thanks to salt), both have significant compute time to prevent easy bruteforce.

It's also important to note, that Django is implemented in Python, which has excellent security track record. Thus the underlying language is not a security risk.

More on Django security: https://docs.djangoproject.com/en/stable/topics/security/

Answer 2

Django is as secure as any web framework can be. It provides tools and doc to prevent common mistakes causing security problems (csrf, xss, etc.)

However, a tool in itself cannot be "secure". The whole platform security depends on the proper use of the tools you choose, and thus is more a matter of developer skills.