第 12 課：安全最佳實踐

Django：從基礎到高級

第 3 部分：身份驗證和安全性

亞洲開發網

1. 安全設定

# settings.py — Production security
SECURE_SSL_REDIRECT = True
SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
SECURE_CONTENT_TYPE_NOSNIFF = True

SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = 'Lax'
SESSION_COOKIE_AGE = 3600

CSRF_COOKIE_SECURE = True
CSRF_COOKIE_HTTPONLY = True

X_FRAME_OPTIONS = 'DENY'

2. SQL注入預防

# SAI — vulnerable
Product.objects.raw(f"SELECT * FROM products WHERE name = '{name}'")

# ĐÚNG — parameterized query
Product.objects.raw("SELECT * FROM products WHERE name = %s", [name])

# ĐÚNG — ORM (tự escape)
Product.objects.filter(name=name)

# Raw SQL an toàn
from django.db import connection
with connection.cursor() as cursor:
    cursor.execute("SELECT * FROM products WHERE price > %s", [min_price])

3.XSS預防

# Django template auto-escapes by default
{{ user_input }}  {# Đã escape #}
{{ user_input|safe }}  {# NGUY HIỂM — tránh dùng #}

# Bleach để sanitize HTML
import bleach
clean_html = bleach.clean(
    user_html,
    tags=['p', 'b', 'i', 'a', 'ul', 'li'],
    attributes={'a': ['href', 'title']},
)

4. 內容安全政策

pip install django-csp

# settings.py
MIDDLEWARE = [..., 'csp.middleware.CSPMiddleware']

CSP_DEFAULT_SRC = ("'self'",)
CSP_SCRIPT_SRC = ("'self'", 'cdn.example.com')
CSP_STYLE_SRC = ("'self'", "'unsafe-inline'")
CSP_IMG_SRC = ("'self'", 'data:', '*.amazonaws.com')

5. 輸入驗證與清理

from django.core.validators import (
    RegexValidator, FileExtensionValidator,
)

class UserProfile(models.Model):
    phone = models.CharField(
        max_length=15,
        validators=[RegexValidator(r'^\+?[0-9]{9,15}$')],
    )
    avatar = models.FileField(
        validators=[FileExtensionValidator(allowed_extensions=['jpg', 'png', 'webp'])],
    )

# File upload size limit
FILE_UPLOAD_MAX_MEMORY_SIZE = 5 * 1024 * 1024  # 5MB
DATA_UPLOAD_MAX_MEMORY_SIZE = 10 * 1024 * 1024

6. 安全檢查表

# Django security check
python manage.py check --deploy

部分	狀態
調試=假	✅
來自環境的 SECRET_KEY	✅
已設定 ALLOWED_HOSTS	✅
僅 HTTPS	✅
啟用 CSRF	✅
SQL參數化	✅
文件上傳已驗證	✅
安全標頭	✅

下一篇： Django 管理自訂。