We take the security of Django REST Auth JWT seriously. This document outlines our security policies and procedures.

• Supported Versions
• Reporting a Vulnerability
• Security Best Practices
• Security Features
• Known Security Considerations
• Security Updates

We release patches for security vulnerabilities for the following versions:

Please DO NOT report security vulnerabilities through public GitHub issues.

Instead, please report them via email to:

📧 Security Email: mobin.ghanbarpour@yahoo.com

When reporting a vulnerability, please include:

1. Description: Detailed description of the vulnerability
2. Impact: Potential impact and attack scenario
3. Reproduction: Steps to reproduce the issue
4. Affected Versions: Which versions are affected
5. Mitigation: Possible mitigation or workarounds (if known)
6. POC: Proof of concept (if available)

Example Report:

Subject: [SECURITY] JWT Token Bypass Vulnerability

## Description
A vulnerability exists that allows bypassing JWT token validation...

## Impact
An attacker could...

## Steps to Reproduce
1. ...
2. ...
3. ...

## Affected Versions
- Version 1.0.0 and below

## Suggested Fix
...

## Additional Information
...

1. Acknowledgment: You'll receive an acknowledgment within 24 hours
2. Assessment: We'll assess the report within 48 hours
3. Updates: We'll keep you informed about our progress
4. Resolution: We aim to release a fix within 7 days for critical issues
5. Credit: You'll be credited in the security advisory (unless you prefer to remain anonymous)

Never commit sensitive information to version control:

# ❌ BAD - Don't do this
SECRET_KEY = "hardcoded-secret-key-123"

# ✅ GOOD - Use environment variables
SECRET_KEY = config("SECRET_KEY")

Generate a strong, unique secret key:

# Generate a new secret key
python -c 'from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())'

Never share or commit your secret key!

Never run with DEBUG=True in production:

# .env file
DEBUG=False  # Always False in production

Configure ALLOWED_HOSTS properly:

# .env file
ALLOWED_HOSTS=yourdomain.com,www.yourdomain.com

Always use HTTPS in production:

# settings.py (production)
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True

• Use strong database passwords
• Limit database user permissions
• Use database connection encryption
• Regular database backups

For production email:

# Use app-specific passwords
EMAIL_HOST_PASSWORD = config("EMAIL_HOST_PASSWORD")

# Use TLS
EMAIL_USE_TLS = True

• Keep access token lifetime short (15-60 minutes)
• Use refresh token rotation
• Implement token blacklisting on logout
• Store tokens securely on client side

Enforce strong passwords:

AUTH_PASSWORD_VALIDATORS = [
    {'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'},
    {'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
     'OPTIONS': {'min_length': 8}},
    {'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator'},
    {'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator'},
]

Implement rate limiting for sensitive endpoints:

# Consider using django-ratelimit or similar
from django_ratelimit.decorators import ratelimit

@ratelimit(key='ip', rate='5/m')
def login_view(request):
    ...

1. Input Validation: Always validate and sanitize user input
2. Output Encoding: Encode output to prevent XSS
3. SQL Injection: Use Django ORM, avoid raw SQL
4. CSRF Protection: Keep CSRF protection enabled
5. Authentication: Always verify user authentication
6. Authorization: Check user permissions
7. Logging: Log security events (without sensitive data)
8. Dependencies: Keep dependencies updated

• No hardcoded credentials
• Input validation implemented
• Authentication checks in place
• Authorization checks in place
• No SQL injection vulnerabilities
• No XSS vulnerabilities
• CSRF protection enabled
• Sensitive data encrypted
• Error messages don't leak information
• Logging doesn't include sensitive data

This project includes:

✅ JWT Authentication

• Secure token-based authentication
• Token expiration and refresh
• Token blacklisting support

✅ Email Verification

• Email ownership verification
• Temporary JWT tokens for verification
• Token expiration

✅ Password Security

• Password hashing (Django's default)
• Password strength validation
• Secure password reset flow

✅ Input Validation

• DRF serializer validation
• Django form validation
• Type checking with type hints

✅ CSRF Protection

• Django's built-in CSRF protection
• Token-based verification

✅ SQL Injection Protection

• Django ORM parameterized queries
• No raw SQL queries

By default, this project uses console.EmailBackend for development. This prints emails to the console and should NEVER be used in production.

For production, configure SMTP:

EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
EMAIL_HOST = 'smtp.gmail.com'
EMAIL_PORT = 587
EMAIL_USE_TLS = True
EMAIL_HOST_USER = config('EMAIL_HOST_USER')
EMAIL_HOST_PASSWORD = config('EMAIL_HOST_PASSWORD')

Tokens should be stored securely on the client side:

• ✅ Use httpOnly cookies (recommended)
• ✅ Use secure, encrypted storage
• ❌ Never store in localStorage (XSS vulnerable)
• ❌ Never store in sessionStorage (XSS vulnerable)

Default CORS settings are restrictive. Configure based on your needs:

CORS_ORIGIN_WHITELIST = [
    "https://yourdomain.com",
    "https://www.yourdomain.com",
]

SQLite is used by default for development. For production:

• Use PostgreSQL, MySQL, or another production database
• Enable connection encryption
• Regular backups
• Proper access controls

1. Watch the Repository: Click "Watch" on GitHub for notifications
2. Check Releases: Review release notes for security fixes
3. Update Dependencies: Regularly update dependencies
4. Subscribe: Star the project to stay informed

# Update to latest version
git pull origin main

# Update dependencies
pip install -r requirements.txt --upgrade

# Run migrations
python manage.py migrate

# Check for security issues
pip check

We regularly update dependencies to patch security vulnerabilities. Check for updates:

# Check for outdated packages
pip list --outdated

# Check for known vulnerabilities
pip-audit
# or
safety check

• Django Security Documentation
• Django Security Releases
• OWASP Top 10

• JWT Best Practices
• JWT Security Considerations

• Python Security
• Bandit - Security Linter
• Safety - Dependency Checker

We recognize and thank security researchers who responsibly disclose vulnerabilities:

No vulnerabilities have been reported yet.

For security concerns:

• Email: mobin.ghanbarpour@yahoo.com
• PGP Key: Available upon request
• Response Time: Within 24 hours

For general issues:

• GitHub Issues: For non-security bugs
• GitHub Discussions: For questions

This security policy may be updated from time to time. Please check back regularly for updates.

Last Updated: October 2025

Thank you for helping keep Django REST Auth JWT and our users safe! 🛡️

Security is everyone's responsibility. 💪