Security

next.dj inherits the Django security model and adds a few subsystem specific surfaces. This section covers how each surface protects against common attacks and how to harden a deployment.

Security overview

The threat model inherited from Django and the additions specific to next.dj.

CSRF and forms

CSRF protection through the {% form %} tag and the re-render pipeline.

Static asset security

Origin, hash, and integrity for shipped CSS and JS.

CSP and nonce

Serving the client runtime under a Content Security Policy.

DI and untrusted input

Treating URL, query, and form values as untrusted.

Reporting a vulnerability

How to disclose a vulnerability privately.