Security — Keeping Pytigon Safe

Pytigon inherits Django's battle-tested security model and extends it with application-specific protections. Security isn't an afterthought — it's baked into the model layer, the view layer, and the template rendering pipeline.

Authentication

Pytigon supports multiple authentication backends:

  • Django session authentication — Default for browser-based access
  • Token authentication — For API clients and mobile apps
  • OAuth2 — For third-party application integration
  • Social authentication — Via django-allauth (Google, Facebook, GitHub, etc.)
  • LDAP — Enterprise directory integration

Configure authentication backends in settings_app.py:

AUTHENTICATION_BACKENDS = [
    'django.contrib.auth.backends.ModelBackend',
    'allauth.account.auth_backends.AuthenticationBackend',
]

Authorization

Permission Model

Django's standard permission system (add, change, delete, view) is extended with custom permissions defined per application:

class Album(JSONModel):
    class Meta:
        permissions = [
            ("export_album", "Can export albums"),
            ("approve_album", "Can approve albums"),
        ]

Row-Level Security

Models can implement filter_by_permissions() to restrict which records a user can see:

@staticmethod
def filter_by_permissions(queryset_or_obj, request):
    if not request.user.is_superuser:
        return queryset_or_obj.filter(department=request.user.department)
    return queryset_or_obj

Menu-Level Security

Menu items are automatically hidden from users who lack the required permissions. Custom permission functions can be defined for complex access rules:

Perms: x|schadmin.applib.perms.if_filer

CSRF Protection

Django's CSRF middleware is active by default. Pytigon's AJAX handlers include the CSRF token automatically:

// Automatically included in all AJAX requests
headers: {
    'X-CSRFToken': ptig.csrf_token
}

SQL Injection Prevention

Pytigon uses Django's ORM exclusively for database access. The ORM's query parameterization prevents SQL injection attacks. Dynamic filters passed through URLs are validated and sanitized before being applied to QuerySets.

XSS Prevention

  • Templates auto-escape by default (Django's behavior)
  • Raw HTML is only rendered when explicitly marked with |safe filter
  • JavaScript data is always JSON-encoded, not string-interpolated

File Upload Security

Uploaded files are: - Stored outside the web root (not directly accessible via URL) - Scanned for content type (MIME type validation) - Size-limited (configured in settings) - Served through a controlled download view (permission-checked)

Security Headers

Recommended production security headers:

SECURE_HSTS_SECONDS = 31536000
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True
X_FRAME_OPTIONS = 'DENY'
?: Security ?: Security