Django 6.0

Apply Python 3 first. Checked against Django 6.0.8. Stay on the latest 6.0 patch, install security releases promptly, and migrate before support ends in April 2027. Use supported Python 3.12, 3.13, or 3.14 micro releases; test all app/middleware dependencies there.

Settings and deployment

• Prefer Django's forms, ORM, templates, authentication, sessions, CSRF, signing, and security middleware to custom security code.
• Deploy explicit ALLOWED_HOSTS, SECRET_KEY, cookie, upload, proxy, and transport settings; reject development defaults/environment-dependent fallbacks.
• Set production DEBUG = False; run manage.py check --deploy with production settings and fix warnings. Use a production WSGI/ASGI server, never manage.py runserver.
• Keep SECRET_KEY_FALLBACKS empty outside rotation: fallback verification costs work after earlier keys fail. Expire old keys with dependent sessions/tokens.

Authentication

• Pass only a user returned by django.contrib.auth.authenticate() to django.contrib.auth.login(); None means failure. Never log in by writing user IDs into request.session yourself, or log out by deleting selected keys; use django.contrib.auth.logout().
• After saving a custom password change, call update_session_auth_hash() to retain the current login and rotate its session key.
• Protect function views with @login_required and class views with leftmost LoginRequiredMixin. For default denial, put LoginRequiredMiddleware after AuthenticationMiddleware; mark public views @login_not_required, keeping login/reset views public to avoid