Django Security - Secret Keys And How to Use Them (With Arun Ravindran)

[@thedumbfounds767]

Big shoutout to Arun! This series wouldn't have been possible without him! If you have any questions, drop them down below.

[@emperorpicard6474]

Just a tip, the excellent django extensions app also has a command called generate_secret_key that will generate a 50 character secret key for you. Also if you use pipenv you can use a .env file to define all of your environment variables for development.

[@thedumbfounds767]

Thanks for the addition, Simon!

[@mahmudsajib8648]

That's a great to. Congo to both of you!

[@isaachatilima]

What of using pip install secret-key-generator?

[@thetechrealms7824]

Awesome! Please make more

[@raghavb1276]

Hi Guys can you please make a tutorial with django saml2 and how to authenticate with a custom user model.

[@thedumbfounds767]

Thx for the suggestion, but I'm not familiar with saml2.

[@assrikanth63]

Thank you for your efforts in making the video possible, straight to the point. Earned a subscriber. One Request: If you can make a video on incorporating all these into a real project with a couple of get/post requests, it will be much appreciated. I have seen your other video in using auth but the calls were still http, if you can discuss in securing your HTTP requests to HTTPS that would be even better. Thanks! and All the best keep going.

[@thedumbfounds767]

Thanks for the sub! Do you mean a video about incorporating the security best practices we talk about in a real project? Covering HTTPS is a good idea, too.

[@assrikanth63]

@@thedumbfounds767 Yes exactly. The video doesn't have to be from scratch or complex, but just a sample pre-written code with minimum functionality like get/post requests and incorporating the security best practices covering HTTPS. I believe it will be a great video. Thanks in Advance!

[@thedumbfounds767]

@@assrikanth63 thanks for the nice suggestion!

[@thomasramses5793]

What about just randomly typing 50 letter/numbers?

[@thedumbfounds767]

Should do the job, I guess!

[@rooneymara8061]

I don't think using the secret key generated on the twitter page you mentioned is safe. An attacker could just scrape the tweets and try them out on your app.

[@thedumbfounds767]

That's why it says "Tempting but not really recommended" on the slide :)

[@rooneymara8061]

@@thedumbfounds767 My bad lol

[@akashkandpal1832]

getting theoretical :(