Security overview#

next.dj relies on Django’s middleware stack and template engine for the bulk of its security guarantees. This page lists the Django mechanisms that apply unchanged and the framework specific surfaces that need extra attention.

Django guarantees used unchanged #

The framework does not bypass any standard Django middleware.

CSRF tokens flow through the standard CsrfViewMiddleware.
Session management uses the standard SessionMiddleware.
Authentication uses AuthenticationMiddleware and the standard auth backends.
Permissions checking, password hashing, and signed cookies remain unchanged.
Django template engine auto escaping is active for every page and component template.

A standard MIDDLEWARE block in settings.py is therefore enough to inherit the full Django security baseline.

Framework specific surfaces #

The framework adds four surfaces that warrant attention.

File router input.: Captured URL parameters and query values reach Python through the dependency resolver. Treat them as untrusted, see DI and untrusted input.
Form dispatch path.: /_next/form/<uid>/ is the dispatch endpoint for every action. See CSRF and forms for the CSRF flow.
Co-located assets.: Component and page level CSS and JS ship through the static collector. See Static asset security for origins, hashes, and integrity.
Partial rendering endpoints.: Zone GET requests and the SSE stream answer partial clients. See Partial rendering for the surface and Access control for the foreign-page rules.

Common threats #

CSRF.: Django middleware plus the framework {% form %} tag covers the standard form path. Manual <form> elements need explicit {% csrf_token %}.
XSS.: Django template auto escaping prevents most cases. Context functions that return mark_safe strings or HTML strings bypass escaping. Apply mark_safe only to values you fully control, and never to untrusted input as covered in DI and untrusted input. The framework escapes <, >, &, U+2028, and U+2029 in the inline init payload, so a serialised value that contains </script> cannot break out of the tag. The remaining risk is that serialised values appear in the page source, so never mark a secret serialize=True, see Static asset security.
SQL injection.: The Django ORM uses parameterised queries. Raw SQL inside a custom provider must use params. See DI and untrusted input for the custom-provider validation pattern.
Mass assignment.: Whitelist editable fields on ModelForm, see DI and untrusted input for the rule.
Origin spoofing.: The only page identity a form submission carries is the _next_form_origin URL path, which the dispatcher resolves through the URLconf with django.urls.resolve(). The client never supplies a filesystem path, so an error re-render can target only pages that are reachable through the routing table anyway. A value that does not resolve returns HTTP 400. Substituting the origin of another routed page remains possible and is an authorization question, so guard mutating actions as described under Access control.
Open redirect.: HttpResponseRedirect accepts any URL. Validate destinations before passing user input into a redirect target. The partial redirect(href, external=True) patch is the same escape hatch on the client side, see Server-authored redirects.
Object-level authorization.: A lookup keyed only on a URL value loads whatever row matches, regardless of who owns it. The ModelForm Meta.instance_from_url lookup is unscoped, so scope it to the user or tenant. See ModelForms for the ownership-scoped pattern and DI and untrusted input for the posted origin path that feeds the lookup.

Server-authored redirects #

A partial response can drive a full client navigation with the visit verb. The default redirect(href) validates the href against the request host, so it cannot leave the site. The external=True flag promotes the navigation to a full visit and bypasses that same-host check, which is what an OAuth or a payment-gateway handoff needs.

The flag trusts the caller to author the href. Pass only a server-controlled destination through it, never a value derived from URL, query, or form input. A user-supplied href behind external=True turns the page into an open redirect, the same risk Django guards against in its login next-page handling. The rule mirrors the plain HttpResponseRedirect case above. Validate or whitelist any destination that traces back to a request value before it reaches the patch.

Access control #

Form actions are unauthenticated by default. The /_next/form/<uid>/ endpoint accepts a POST from any visitor, so a registered edit or delete action runs without an identity check unless the handler adds one.

Enforce access at one of these layers.

Declare Meta.login_required and Meta.permission_required on the form class, or the same keywords on @action, for a static guard checked before any application code, see Access guards.
Override check_permissions or has_object_permission on the form class for a per-request decision against the database, the tenant, or the loaded row, see Dynamic permission hooks.
Check request.user.is_authenticated and ownership inside on_valid before self.save().
Apply a project-wide login requirement through middleware, see Require login on file-routed pages.
Enforce a policy in a custom form action backend that wraps every dispatch.

An action that mutates data and an action that loads an instance through instance_from_url both need this guard. The Enforce object-level permissions recipe shows the owner-only edit on a ModelForm.

The out-of-band morph path enforces page-level access on its own. A morph(zone=..., page=...) onto a foreign page re-runs that page’s authorization chain and raises ForeignPageNotAuthorizedError on a denial or DynamicForeignPageError for a dynamic body, see Partial rendering reference.

Production hardening #

A short list of production specific settings.

Set SECURE_SSL_REDIRECT = True to redirect every HTTP request to HTTPS.
Set SECURE_CONTENT_TYPE_NOSNIFF = True to block MIME-type sniffing.
Set SECURE_HSTS_SECONDS = 31536000 to send a one-year HSTS header.
Set SECURE_HSTS_INCLUDE_SUBDOMAINS = True to extend HSTS to all subdomains.
Set SECURE_HSTS_PRELOAD = True to allow submission to the HSTS preload list.
Set SESSION_COOKIE_SECURE = True to send the session cookie only over HTTPS.
Set CSRF_COOKIE_SECURE = True to send the CSRF cookie only over HTTPS.
Set CSRF_TRUSTED_ORIGINS = ["https://..."] to restrict cross-origin form submissions to listed origins.

Run uv run python manage.py check --deploy and resolve every warning. See Deployment checklist for the full pre-deploy review.

System checks #

The framework system checks cover configuration mistakes that affect security.

next.E041 reports two actions registered under the same name from different handlers.
next.E045 reports a form action backend that does not subclass FormActionBackend.
next.E020 reports a component registered more than once within the same scope.

Run them with uv run python manage.py check.