Security issues with serving static files through Django?

Question

The official docs say, of the staticfiles serve view:

... this view is grossly inefficient and probably insecure

Does this warning apply only to this particular view, or are there security issues inherent in the concept of serving static files through Django? What are they? Assuming I've benchmarked my application and performance is acceptable, are there any other issues I should be aware of?

Answer 1

It's insecure because it doesn't have to be secure

Serving static files through django means you go through the Python code to do something your webserver would do significantly more efficiently.

Given that serving static files is disastrous performance-wise, no-one would use this in production.
Therefore, no-one cares about the security of serving static files in Django.
As a consequence, this view is probably insecure.

---

Ultimately, it's the same rationale as the development server. You're not supposed to be using it in production and not one is dedicating effort to making it secure. It's just practical for development.

Also, something inefficient is something that exposes you to DoS attacks. So yes, it's insecure.

But you shouldn't be using it.

Why are you serving static files through Django? Is it to control access to those files?

If yes, you should use the X-Accel-Redirect(Nginx) or X-Sendfile (Apache) headers.

But don't do it yourself, use: https://github.com/johnsensible/django-sendfile