Is Django a good choice for a security critical application?

Question

Is Django a good choice for a security critical application?

I am asking this because most of the online banking software is built using Java. Is there any real reason for this?

Answer 1

Actually, the security in Java and Python is the same. Digest-only password handling, cookies that timeout rapidly, careful deletion of sessions, multi-factor authentication. None of this is unique to a Java framework or a Python framework like Django.

Django, indeed, has a security backend architecture that allows you to add your own LDAP (or AD) connection, possibly changing the digest technique used.

Django has a Profile model where you can keep additional authentication factors.

Django offers a few standard decorators for view function authorization checking. Since Python is so flexible, you can trivially write your own decorator functions to layer in different or additional authentication checking.

Security is a number of first-class features in Django.

Answer 2

Probably the reason behind Java is not in the in the security. I think Java is more used in large development companies and banks usually resort to them for their development needs (which probably are not only related to the web site but creep deeper in the backend).

So, I see no security reasons, mostly cultural ones.