Django · Section 4

Settings and Configuration

What every core setting (INSTALLED_APPS, MIDDLEWARE, DATABASES, CACHES...) actually controls, the security settings that guard against a forged host header or a stolen cookie, the HTTPS/HSTS settings that only matter with real traffic, and the strategy for keeping secrets out of settings.py entirely.

Difficulty: intermediate42 min3 parts6 concepts
This section
Django Tutorial 1 - Project Settings and Configuration - Hacked ExistenceHackedExistence

In this section

3 parts
  1. Core settingsThe settings that wire together what exists (apps, middleware, routing, templates, the database), plus locale, static/media, cache, email, logging, and server-entry settings.3 standard3 concepts
  2. Security settingsSECRET_KEY, DEBUG, host validation, cookie security, and the HTTPS/HSTS/reverse-proxy settings that only matter once real traffic is involved.2 core2 concepts
  3. Configuration strategyWhere a configuration value should actually live — environment variables, a secret manager, or a per-environment settings file — and how to keep the unsafe case from being the silent default.1 core1 concept