Django 6.1

Last reviewed Oct 11, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Python 3155 lines · 3.8K tokens
  2. Django 6.1140 lines · 4.1K tokens
Total295 lines · 7.9K tokens

CWE Coverage

  • 20
  • 23
  • 36
  • 59
  • 73
  • 78
  • 79
  • 89
  • 95
  • 117
  • 201
  • 203
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 307
  • 319
  • 328
  • 338
  • 347
  • 352
  • 367
  • 379
  • 384
  • 409
  • 416
  • 426
  • 427
  • 434
  • 470
  • 502
  • 521
  • 524
  • 532
  • 601
  • 611
  • 614
  • 639
  • 674
  • 732
  • 770
  • 772
  • 776
  • 778
  • 798
  • 807
  • 829
  • 862
  • 915
  • 916
  • 918
  • 942
  • 1004
  • 1021
  • 1104
  • 1275
  • 1333
  • 1336
  • 1395

Prompt Preview

Apply Python 3 first. These rules cover Django 6.1.1 and supported 6.1 releases. Use the latest 6.1 patch on Python 3.12, 3.13, or 3.14; migrate before extended support ends in December 2027.

Production baseline

  • Keep DEBUG = False; run manage.py check --deploy with deployed settings and fix all applicable warnings before release.
  • Use a production WSGI/ASGI server behind a deliberately configured proxy, never manage.py runserver.
  • Pin Django to the 6.1 line, install patch releases promptly, and test the application, middleware, database driver, and deployment server on the exact Python micro release in production.
  • Use only supported database versions: PostgreSQL 15+, MySQL 8.4+, MariaDB 10.11+, Oracle 19c+, or SQLite 3.37+.
  • Load SECRET_KEY, database/mail credentials, API keys, signing material from protected runtime config, never source, templates, logs, client settings.
  • Keep SECRET_KEY_FALLBACKS empty outside bounded rotation; remove old keys when all dependent sessions/tokens expire.
  • Prefer Django forms, templates, ORM, authentication, sessions, CSRF, signing, CSP, security middleware over custom equivalents.

Request, host, and proxy boundaries

  • Set exact production ALLOWED_HOSTS; unavoidable wildcards require host-validation middleware before any host consumer.
  • Read hosts with request.get_host(), never raw/forwarded headers from request.META.
  • Set SECURE_PROXY_SSL_HEADER/USE_X_FORWARDED_HOST only when trusted proxies strip all client forwarding headers and supply authoritative values.
  • Set finite request limits at the proxy