Built-in Middleware Overview
In this page:
SecurityMiddleware
SecurityMiddleware adds a set of HTTP security headers to every response, such as protections against clickjacking and MIME-type sniffing.
Example: SecurityMiddleware
SecurityMiddleware adds a set of HTTP security headers to every response, such as protections against clickjacking and MIME-type sniffing.
MIDDLEWARE = [
"django.middleware.security.SecurityMiddleware",
]
SECURE_BROWSER_XSS_FILTER = TrueSessionMiddleware & AuthenticationMiddleware
SessionMiddleware attaches request.session, and AuthenticationMiddleware uses that session to attach request.user — together they power Django's login system.
Example: SessionMiddleware & AuthenticationMiddleware
SessionMiddleware attaches request.session, and AuthenticationMiddleware uses that session to attach request.user — together they power Django's login system.
MIDDLEWARE = [
"django.contrib.sessions.middleware.SessionMiddleware",
"django.contrib.auth.middleware.AuthenticationMiddleware",
]CsrfViewMiddleware
CsrfViewMiddleware checks that POST requests include a valid CSRF token, protecting forms from cross-site request forgery attacks.
Example: CsrfViewMiddleware
CsrfViewMiddleware checks that POST requests include a valid CSRF token, protecting forms from cross-site request forgery attacks.
MIDDLEWARE = [
"django.middleware.csrf.CsrfViewMiddleware",
]CommonMiddleware
CommonMiddleware handles small conveniences like appending a trailing slash to URLs that are missing one, controlled by APPEND_SLASH.
Example: CommonMiddleware
CommonMiddleware handles small conveniences like appending a trailing slash to URLs that are missing one, controlled by APPEND_SLASH.
MIDDLEWARE = [
"django.middleware.common.CommonMiddleware",
]
APPEND_SLASH = True- Removing SecurityMiddleware or CsrfViewMiddleware without understanding what protection they remove.
- Not realizing AuthenticationMiddleware is what makes request.user available in views.
- Assuming all built-in middleware is required — some, like GZipMiddleware, are optional performance add-ons.
- SecurityMiddleware adds HTTP security headers like HSTS and content-type sniffing protection.
- SessionMiddleware and AuthenticationMiddleware together make request.user and sessions work.
- CsrfViewMiddleware protects POST forms from cross-site request forgery.
- CommonMiddleware handles things like URL normalization.
Chapter Quiz — Complete all 8 topics to unlock
0/8 topics done
Complete these topics first: