1回答

Jack

2019-04-29

cookiecutter也可以搭建前后端分离的项目（用cookiecutter-django-rest），保证安全这问题就广泛了，常见的xss，csrf，防sql注入框架都搞定了，django settings.py里面有很多安全配置相关的选项，比如，视频里会慢慢讲到

# SECURITY
# ------------------------------------------------------------------------------
# https://docs.djangoproject.com/en/dev/ref/settings/#session-cookie-httponly
SESSION_COOKIE_HTTPONLY = True
# https://docs.djangoproject.com/en/dev/ref/settings/#csrf-cookie-httponly
CSRF_COOKIE_HTTPONLY = False  # 默认为False, 如果设置为True, JS将不能获取到CSRF cookie
# https://docs.djangoproject.com/en/dev/ref/settings/#secure-browser-xss-filter
SECURE_BROWSER_XSS_FILTER = True
# https://docs.djangoproject.com/en/dev/ref/settings/#x-frame-options
X_FRAME_OPTIONS = 'DENY'

部署的时候用https。

1

0