Logo of a fox dressed as a Doctor

Code Review Doctor

Verified by GitHub
GitHub integrationPython checksDjango checksDemoCheck repository

Clickjacking protection not activated

Your website is vulnerable to clickjack attack because the MIDDLEWARE setting is missing django.middleware.clickjacking.XFrameOptionsMiddleware - so users can be tricked into interacting with your website without realising.

If unprotected, an invisible iframe pointing at your site can be placed on top of a innocent looking button on the malicious web page - so when the user clicks the innocent button they'are actually interacting with a button on your web page.

You may find iframes useful though, so, so Django allows setting the policy to SAMEORIGIN via X_FRAME_OPTIONS = 'SAMEORIGIN'

If our GitHub code review bot spots this issue in your pull request it gives this advice:

django-doctorbotsuggested changes just now
settings.py
1
+
MIDDLEWARE = [
2
+
    'django.middleware.common.CommonMiddleware',
3
+
    'django.contrib.sessions.middleware.SessionMiddleware',
4
+
    ...
Your website is vulnerable to clickjack attack because the MIDDLEWARE setting is missing django.middleware.clickjacking.XFrameOptionsMiddleware - so users can be tricked into interacting with your website without realising.
Read more
Suggested changes
+
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
Expand 2 lines ...
Commit suggestion
5
+
]
Update settings.py
Instantly check if you have this issue for free
    Works with tools you use
    Read about how it works.