Data Structure
Networking
RDBMS
Operating System
Java
MS Excel
iOS
HTML
CSS
Android
Python
C Programming
C++
C#
MongoDB
MySQL
Javascript
PHP
Physics
Chemistry
Biology
Mathematics
English
Economics
Psychology
Social Studies
Fashion Studies
Legal Studies
- Selected Reading
- UPSC IAS Exams Notes
- Developer's Best Practices
- Questions and Answers
- Effective Resume Writing
- HR Interview Questions
- Computer Glossary
- Who is Who
How to make Django admin more secure?
Django is a web framework that is popular for its ease of usage. Django like many other web frameworks comes equipped with a lot of features and functionalities that can be used without much code to write. Django-admin is one of those features.
The automatic admin interface is one of Django's most powerful features. It reads metadata from your models to create a model-centric interface for trusted users to manage content on your site. The admin's recommended use is limited to the internal management tool of an organization. It is not meant to be the foundation for your complete front end.
The admin offers a lot of hooks for modification, but do not rely on them completely. It is probably time to develop your own views if you need to give a more process-centric interface that abstracts away the implementation specifics of database tables and fields.
Some tips to ensure that your django project is secure are discussed below.
Using Secure Sockets Layer(SSL)
Deploying your project on HTTPS is important. If not, there is a possibility for someone to gather data from your web application when you are in a public place.
Change the default admin URL from /admin/ to another name. if needed, host the admin in a different domain entirely.
Change your domain as shown below.
urlpatterns=[ path(‘/admin/’, admin.site,urls), ]
Change the above mentioned URL to something that is not common and not very easily accessible or recognized.
Urlpatterns=[ path(‘my-special-tts-admin’, admin.site,urls), ]
Use two-factor authentication
When you demand a password plus something else to authenticate a user for your site, you're using two-factor authentication (2FA). Apps that need a password and then text you a second login code before allowing you to log in are likely employing two-factor authentication (2FA).
You may enable 2FA on your site in three ways −
2FA through SMS, which entails texting a login code. Although this is preferable to simply needing a password, SMS messages are surprisingly easy to intercept.
Two-factor authentication through an app like Google Authenticator, which produces unique login codes for whatever service you sign up for. Users will need to scan a QR code on your website to register it with these apps.The app will then generate a login code that they can use to access your website.
Using a YubiKey to enable 2FA on your site is the safest option. When your users try to log in, they must have a physical device, such as a YubiKey, which they must plug into a USB port.
Any of the 2FA techniques mentioned above can be enabled with the help of the django-two-factor-auth module.
Make sure to emphasize the need for stringer passwords and make sure you maintain stronger passwords for admin pages/site.
Make sure to install django-admin-honeypot.
Install the django-admin-honeypot library on your old /admim/ URL to collect attempts to hack your site if you've relocated it to a new URL or even chosen to host it on its own domain.
When someone tries to get in to your previous /admin/ URL, django-admin-honeypot generates a phoney admin login screen and emails your site administrators.
The attacker's IP address will be included in the email created by django-admin-honeypot, so if you detect repeated login attempts from the same IP address, you can restrict that address from using your site for further security.
Always make sure to use the latest version of Django since it has security upgrades and bug fixes.
Remembering the environment, you are in and using, will let you be aware of any changes to the production data.
371 Views
