Warning
Be careful when you override settings, especially when the default value is a non-empty tuple or dictionary, such as MIDDLEWARE_CLASSES and TEMPLATE_CONTEXT_PROCESSORS. Make sure you keep the components required by the features of Django you wish to use.
Here’s a full list of all available settings, in alphabetical order, and their default values.
Default: {} (Empty dictionary)
A dictionary mapping "app_label.model_name" strings to functions that take a model object and return its URL. This is a way of overriding get_absolute_url() methods on a per-installation basis. Example:
ABSOLUTE_URL_OVERRIDES = {
'blogs.weblog': lambda o: "/blogs/%s/" % o.slug,
'news.story': lambda o: "/stories/%s/%s/" % (o.pub_year, o.slug),
}
Note that the model name used in this setting should be all lower-case, regardless of the case of the actual model class name.
Default: () (Empty tuple)
Used for admin-site settings modules, this should be a tuple of settings modules (in the format 'foo.bar.baz') for which this site is an admin.
The admin site uses this in its automatically-introspected documentation of models, views and template tags.
Default: () (Empty tuple)
A tuple that lists people who get code error notifications. When DEBUG=False and a view raises an exception, Django will email these people with the full exception information. Each member of the tuple should be a tuple of (Full name, email address). Example:
(('John', 'john@example.com'), ('Mary', 'mary@example.com'))
Note that Django will email all of these people whenever an error happens. See Error reporting for more information.
Default: () (Empty tuple)
A tuple of strings representing allowed prefixes for the {% ssi %} template tag. This is a security measure, so that template authors can’t access files that they shouldn’t be accessing.
For example, if ALLOWED_INCLUDE_ROOTS is ('/home/html', '/var/www'), then {% ssi /home/html/foo.txt %} would work, but {% ssi /etc/passwd %} wouldn’t.
Default: True
When set to True, if the request URL does not match any of the patterns in the URLconf and it doesn’t end in a slash, an HTTP redirect is issued to the same URL with a slash appended. Note that the redirect may cause any data submitted in a POST request to be lost.
The APPEND_SLASH setting is only used if CommonMiddleware is installed (see Middleware). See also PREPEND_WWW.
Default: ('django.contrib.auth.backends.ModelBackend',)
A tuple of authentication backend classes (as strings) to use when attempting to authenticate a user. See the authentication backends documentation for details.
Default: ‘auth.User’
The model to use to represent a User. See Substituting a custom User model.
Default:
{
'default': {
'BACKEND': 'django.core.cache.backends.locmem.LocMemCache',
}
}
A dictionary containing the settings for all caches to be used with Django. It is a nested dictionary whose contents maps cache aliases to a dictionary containing the options for an individual cache.
The CACHES setting must configure a default cache; any number of additional caches may also be specified. If you are using a cache backend other than the local memory cache, or you need to define multiple caches, other options will be required. The following cache options are available.
Default: '' (Empty string)
The cache backend to use. The built-in cache backends are:
You can use a cache backend that doesn’t ship with Django by setting BACKEND to a fully-qualified path of a cache backend class (i.e. mypackage.backends.whatever.WhateverCache). Writing a whole new cache backend from scratch is left as an exercise to the reader; see the other backends for examples.
A string containing a dotted path to a function that defines how to compose a prefix, version and key into a final cache key. The default implementation is equivalent to the function:
def make_key(key, key_prefix, version):
return ':'.join([key_prefix, str(version), key])
You may use any key function you want, as long as it has the same argument signature.
See the cache documentation for more information.
Default: '' (Empty string)
A string that will be automatically included (prepended by default) to all cache keys used by the Django server.
See the cache documentation for more information.
Default: '' (Empty string)
The location of the cache to use. This might be the directory for a file system cache, a host and port for a memcache server, or simply an identifying name for a local memory cache. e.g.:
CACHES = {
'default': {
'BACKEND': 'django.core.cache.backends.filebased.FileBasedCache',
'LOCATION': '/var/tmp/django_cache',
}
}
Default: None
Extra parameters to pass to the cache backend. Available parameters vary depending on your cache backend.
Some information on available parameters can be found in the Cache Backends documentation. For more information, consult your backend module’s own documentation.
Default: 1
The default version number for cache keys generated by the Django server.
See the cache documentation for more information.
Default: False
If the value of this setting is True, only anonymous requests (i.e., not those made by a logged-in user) will be cached. Otherwise, the middleware caches every page that doesn’t have GET or POST parameters.
If you set the value of this setting to True, you should make sure you’ve activated AuthenticationMiddleware.
Default: '' (Empty string)
The cache key prefix that the cache middleware should use.
Default: 600
The default number of seconds to cache a page when the caching middleware or cache_page() decorator is used.
Default: None
The domain to be used when setting the CSRF cookie. This can be useful for easily allowing cross-subdomain requests to be excluded from the normal cross site request forgery protection. It should be set to a string such as ".example.com" to allow a POST request from a form on one subdomain to be accepted by accepted by a view served from another subdomain.
Please note that the presence of this setting does not imply that Django’s CSRF protection is safe from cross-subdomain attacks by default - please see the CSRF limitations section.
Default: 'csrftoken'
The name of the cookie to use for the CSRF authentication token. This can be whatever you want. See Cross Site Request Forgery protection.
Default: '/'
The path set on the CSRF cookie. This should either match the URL path of your Django installation or be a parent of that path.
This is useful if you have multiple Django instances running under the same hostname. They can use different cookie paths, and each instance will only see its own CSRF cookie.
Default: False
Whether to use a secure cookie for the CSRF cookie. If this is set to True, the cookie will be marked as “secure,” which means browsers may ensure that the cookie is only sent under an HTTPS connection.
Default: 'django.views.csrf.csrf_failure'
A dotted path to the view function to be used when an incoming request is rejected by the CSRF protection. The function should have this signature:
def csrf_failure(request, reason="")
where reason is a short message (intended for developers or logging, not for end users) indicating the reason the request was rejected. See Cross Site Request Forgery protection.
Default: {} (Empty dictionary)
A dictionary containing the settings for all databases to be used with Django. It is a nested dictionary whose contents maps database aliases to a dictionary containing the options for an individual database.
The DATABASES setting must configure a default database; any number of additional databases may also be specified.
The simplest possible settings file is for a single-database setup using SQLite. This can be configured using the following:
DATABASES = {
'default': {
'ENGINE': 'django.db.backends.sqlite3',
'NAME': 'mydatabase'
}
}
For other database backends, or more complex SQLite configurations, other options will be required. The following inner options are available.
Default: '' (Empty string)
The database backend to use. The built-in database backends are:
You can use a database backend that doesn’t ship with Django by setting ENGINE to a fully-qualified path (i.e. mypackage.backends.whatever). Writing a whole new database backend from scratch is left as an exercise to the reader; see the other backends for examples.
Default: '' (Empty string)
Which host to use when connecting to the database. An empty string means localhost. Not used with SQLite.
If this value starts with a forward slash ('/') and you’re using MySQL, MySQL will connect via a Unix socket to the specified socket. For example:
"HOST": '/var/run/mysql'
If you’re using MySQL and this value doesn’t start with a forward slash, then this value is assumed to be the host.
If you’re using PostgreSQL, by default (empty HOST), the connection to the database is done through UNIX domain sockets (‘local’ lines in pg_hba.conf). If you want to connect through TCP sockets, set HOST to ‘localhost’ or ‘127.0.0.1’ (‘host’ lines in pg_hba.conf). On Windows, you should always define HOST, as UNIX domain sockets are not available.
Default: '' (Empty string)
The name of the database to use. For SQLite, it’s the full path to the database file. When specifying the path, always use forward slashes, even on Windows (e.g. C:/homes/user/mysite/sqlite3.db).
Default: {} (Empty dictionary)
Extra parameters to use when connecting to the database. Available parameters vary depending on your database backend.
Some information on available parameters can be found in the Database Backends documentation. For more information, consult your backend module’s own documentation.
Default: '' (Empty string)
The password to use when connecting to the database. Not used with SQLite.
Default: '' (Empty string)
The port to use when connecting to the database. An empty string means the default port. Not used with SQLite.
Default: '' (Empty string)
The username to use when connecting to the database. Not used with SQLite.
Default: None
The character set encoding used to create the test database. The value of this string is passed directly through to the database, so its format is backend-specific.
Supported for the PostgreSQL (postgresql_psycopg2) and MySQL (mysql) backends.
Default: None
The collation order to use when creating the test database. This value is passed directly to the backend, so its format is backend-specific.
Only supported for the mysql backend (see the MySQL manual for details).
Default: ['default'], for all databases other than default, which has no dependencies.
The creation-order dependencies of the database. See the documentation on controlling the creation order of test databases for details.
Default: None
The alias of the database that this database should mirror during testing.
This setting exists to allow for testing of master/slave configurations of multiple databases. See the documentation on testing master/slave configurations for details.
Default: None
The name of database to use when running the test suite.
If the default value (None) is used with the SQLite database engine, the tests will use a memory resident database. For all other database engines the test database will use the name 'test_' + DATABASE_NAME.
See The test database.
Default: True
This is an Oracle-specific setting.
If it is set to False, the test tablespaces won’t be automatically created at the beginning of the tests and dropped at the end.
Default: None
This is an Oracle-specific setting.
The username to use when connecting to the Oracle database that will be used when running tests. If not provided, Django will use 'test_' + USER.
Default: True
This is an Oracle-specific setting.
If it is set to False, the test user won’t be automatically created at the beginning of the tests and dropped at the end.
Default: None
This is an Oracle-specific setting.
The password to use when connecting to the Oracle database that will be used when running tests. If not provided, Django will use a hardcoded default value.
Default: None
This is an Oracle-specific setting.
The name of the tablespace that will be used when running tests. If not provided, Django will use 'test_' + NAME.
Default: None
This is an Oracle-specific setting.
The name of the temporary tablespace that will be used when running tests. If not provided, Django will use 'test_' + NAME + '_temp'.
Default: [] (Empty list)
The list of routers that will be used to determine which database to use when performing a database queries.
See the documentation on automatic database routing in multi database configurations.
Default: 'N j, Y' (e.g. Feb. 4, 2003)
The default formatting to use for displaying date fields in any part of the system. Note that if USE_L10N is set to True, then the locale-dictated format has higher precedence and will be applied instead. See allowed date format strings.
See also DATETIME_FORMAT, TIME_FORMAT and SHORT_DATE_FORMAT.
Default:
('%Y-%m-%d', '%m/%d/%Y', '%m/%d/%y', '%b %d %Y',
'%b %d, %Y', '%d %b %Y', '%d %b, %Y', '%B %d %Y',
'%B %d, %Y', '%d %B %Y', '%d %B, %Y')
A tuple of formats that will be accepted when inputting data on a date field. Formats will be tried in order, using the first valid one. Note that these format strings use Python’s datetime module syntax, not the format strings from the date Django template tag.
When USE_L10N is True, the locale-dictated format has higher precedence and will be applied instead.
See also DATETIME_INPUT_FORMATS and TIME_INPUT_FORMATS.
Default: 'N j, Y, P' (e.g. Feb. 4, 2003, 4 p.m.)
The default formatting to use for displaying datetime fields in any part of the system. Note that if USE_L10N is set to True, then the locale-dictated format has higher precedence and will be applied instead. See allowed date format strings.
See also DATE_FORMAT, TIME_FORMAT and SHORT_DATETIME_FORMAT.
Default:
('%Y-%m-%d %H:%M:%S', '%Y-%m-%d %H:%M', '%Y-%m-%d',
'%m/%d/%Y %H:%M:%S', '%m/%d/%Y %H:%M', '%m/%d/%Y',
'%m/%d/%y %H:%M:%S', '%m/%d/%y %H:%M', '%m/%d/%y')
A tuple of formats that will be accepted when inputting data on a datetime field. Formats will be tried in order, using the first valid one. Note that these format strings use Python’s datetime module syntax, not the format strings from the date Django template tag.
When USE_L10N is True, the locale-dictated format has higher precedence and will be applied instead.
See also DATE_INPUT_FORMATS and TIME_INPUT_FORMATS.
Default: False
A boolean that turns on/off debug mode.
Never deploy a site into production with DEBUG turned on.
Did you catch that? NEVER deploy a site into production with DEBUG turned on.
One of the main features of debug mode is the display of detailed error pages. If your app raises an exception when DEBUG is True, Django will display a detailed traceback, including a lot of metadata about your environment, such as all the currently defined Django settings (from settings.py).
As a security measure, Django will not include settings that might be sensitive (or offensive), such as SECRET_KEY or PROFANITIES_LIST. Specifically, it will exclude any setting whose name includes any of the following:
- API
- KEY
- PASS
- PROFANITIES_LIST
- SECRET
- SIGNATURE
- TOKEN
Note that these are partial matches. 'PASS' will also match PASSWORD, just as 'TOKEN' will also match TOKENIZED and so on.
Still, note that there are always going to be sections of your debug output that are inappropriate for public consumption. File paths, configuration options and the like all give attackers extra information about your server.
It is also important to remember that when running with DEBUG turned on, Django will remember every SQL query it executes. This is useful when you’re debugging, but it’ll rapidly consume memory on a production server.
Default: False
If set to True, Django’s normal exception handling of view functions will be suppressed, and exceptions will propagate upwards. This can be useful for some test setups, and should never be used on a live site.
Default: '.' (Dot)
Default decimal separator used when formatting decimal numbers.
Note that if USE_L10N is set to True, then the locale-dictated format has higher precedence and will be applied instead.
See also NUMBER_GROUPING, THOUSAND_SEPARATOR and USE_THOUSAND_SEPARATOR.
Default: 'utf-8'
Default charset to use for all HttpResponse objects, if a MIME type isn’t manually specified. Used with DEFAULT_CONTENT_TYPE to construct the Content-Type header.
Default: 'text/html'
Default content type to use for all HttpResponse objects, if a MIME type isn’t manually specified. Used with DEFAULT_CHARSET to construct the Content-Type header.
Default: django.views.debug.SafeExceptionReporterFilter
Default exception reporter filter class to be used if none has been assigned to the HttpRequest instance yet. See Filtering error reports.
Default: django.core.files.storage.FileSystemStorage
Default file storage class to be used for any file-related operations that don’t specify a particular storage system. See Managing files.
Default: 'webmaster@localhost'
Default email address to use for various automated correspondence from the site manager(s).
Default: '' (Empty string)
Default tablespace to use for indexes on fields that don’t specify one, if the backend supports it (see Tablespaces).
Default: '' (Empty string)
Default tablespace to use for models that don’t specify one, if the backend supports it (see Tablespaces).
Default: () (Empty tuple)
List of compiled regular expression objects representing User-Agent strings that are not allowed to visit any page, systemwide. Use this for bad robots/crawlers. This is only used if CommonMiddleware is installed (see Middleware).
Default: 'django.core.mail.backends.smtp.EmailBackend'
The backend to use for sending emails. For the list of available backends see Sending email.
Default: Not defined
The directory used by the file email backend to store output files.
Default: '' (Empty string)
Password to use for the SMTP server defined in EMAIL_HOST. This setting is used in conjunction with EMAIL_HOST_USER when authenticating to the SMTP server. If either of these settings is empty, Django won’t attempt authentication.
See also EMAIL_HOST_USER.
Default: '' (Empty string)
Username to use for the SMTP server defined in EMAIL_HOST. If empty, Django won’t attempt authentication.
See also EMAIL_HOST_PASSWORD.
Default: '[Django] '
Subject-line prefix for email messages sent with django.core.mail.mail_admins or django.core.mail.mail_managers. You’ll probably want to include the trailing space.
Default: False
Whether to use a TLS (secure) connection when talking to the SMTP server.
Default: 'utf-8'
The character encoding used to decode any files read from disk. This includes template files and initial SQL data files.
Default:
("django.core.files.uploadhandler.MemoryFileUploadHandler",
"django.core.files.uploadhandler.TemporaryFileUploadHandler",)
A tuple of handlers to use for uploading. See Managing files for details.
Default: 2621440 (i.e. 2.5 MB).
The maximum size (in bytes) that an upload will be before it gets streamed to the file system. See Managing files for details.
Default: None
The numeric mode (i.e. 0644) to set newly uploaded files to. For more information about what these modes mean, see the documentation for os.chmod().
If this isn’t given or is None, you’ll get operating-system dependent behavior. On most platforms, temporary files will have a mode of 0600, and files saved from memory will be saved using the system’s standard umask.
Warning
Always prefix the mode with a 0.
If you’re not familiar with file modes, please note that the leading 0 is very important: it indicates an octal number, which is the way that modes must be specified. If you try to use 644, you’ll get totally incorrect behavior.
Default: None
The directory to store data temporarily while uploading files. If None, Django will use the standard temporary directory for the operating system. For example, this will default to ‘/tmp’ on *nix-style operating systems.
See Managing files for details.
Default: 0 (Sunday)
Number representing the first day of the week. This is especially useful when displaying a calendar. This value is only used when not using format internationalization, or when a format cannot be found for the current locale.
The value must be an integer from 0 to 6, where 0 means Sunday, 1 means Monday and so on.
Default: () (Empty tuple)
List of directories searched for fixture files, in addition to the fixtures directory of each application, in search order.
Note that these paths should use Unix-style forward slashes, even on Windows.
See Providing initial data with fixtures and Fixture loading.
Default: None
If not None, this will be used as the value of the SCRIPT_NAME environment variable in any HTTP request. This setting can be used to override the server-provided value of SCRIPT_NAME, which may be a rewritten version of the preferred value or not supplied at all.
Default: None
A full Python path to a Python package that contains format definitions for project locales. If not None, Django will check for a formats.py file, under the directory named as the current locale, and will use the formats defined on this file.
For example, if FORMAT_MODULE_PATH is set to mysite.formats, and current language is en (English), Django will expect a directory tree like:
mysite/
formats/
__init__.py
en/
__init__.py
formats.py
Available formats are DATE_FORMAT, TIME_FORMAT, DATETIME_FORMAT, YEAR_MONTH_FORMAT, MONTH_DAY_FORMAT, SHORT_DATE_FORMAT, SHORT_DATETIME_FORMAT, FIRST_DAY_OF_WEEK, DECIMAL_SEPARATOR, THOUSAND_SEPARATOR and NUMBER_GROUPING.
Default: ()
List of compiled regular expression objects describing URLs that should be ignored when reporting HTTP 404 errors via email (see Error reporting). Regular expressions are matched against request's full paths (including query string, if any). Use this if your site does not provide a commonly requested file such as favicon.ico or robots.txt, or if it gets hammered by script kiddies.
This is only used if SEND_BROKEN_LINK_EMAILS is set to True and CommonMiddleware is installed (see Middleware).
Default: () (Empty tuple)
A tuple of strings designating all applications that are enabled in this Django installation. Each string should be a full Python path to a Python package that contains a Django application, as created by django-admin.py startapp.
App names must be unique
The application names (that is, the final dotted part of the path to the module containing models.py) defined in INSTALLED_APPS must be unique. For example, you can’t include both django.contrib.auth and myproject.auth in INSTALLED_APPS.
Default: () (Empty tuple)
A tuple of IP addresses, as strings, that:
Default: 'en-us'
A string representing the language code for this installation. This should be in standard language format. For example, U.S. English is "en-us". See Internationalization and localization.
Default: 'django_language'
The name of the cookie to use for the language cookie. This can be whatever you want (but should be different from SESSION_COOKIE_NAME). See Internationalization and localization.
Default: A tuple of all available languages. This list is continually growing and including a copy here would inevitably become rapidly out of date. You can see the current list of translated languages by looking in django/conf/global_settings.py (or view the online source).
The list is a tuple of two-tuples in the format (language code, language name), the language code part should be a language name – for example, ('ja', 'Japanese'). This specifies which languages are available for language selection. See Internationalization and localization.
Generally, the default value should suffice. Only set this setting if you want to restrict language selection to a subset of the Django-provided languages.
If you define a custom LANGUAGES setting, it’s OK to mark the languages as translation strings (as in the default value referred to above) – but use a “dummy” gettext() function, not the one in django.utils.translation. You should never import django.utils.translation from within your settings file, because that module in itself depends on the settings, and that would cause a circular import.
The solution is to use a “dummy” gettext() function. Here’s a sample settings file:
gettext = lambda s: s
LANGUAGES = (
('de', gettext('German')),
('en', gettext('English')),
)
With this arrangement, django-admin.py makemessages will still find and mark these strings for translation, but the translation won’t happen at runtime – so you’ll have to remember to wrap the languages in the real gettext() in any code that uses LANGUAGES at runtime.
Default: () (Empty tuple)
A tuple of directories where Django looks for translation files. See How Django discovers translations.
Example:
LOCALE_PATHS = (
'/home/www/project/common_files/locale',
'/var/local/translations/locale'
)
Django will look within each of these paths for the <locale_code>/LC_MESSAGES directories containing the actual translation files.
Default: A logging configuration dictionary.
A data structure containing configuration information. The contents of this data structure will be passed as the argument to the configuration method described in LOGGING_CONFIG.
The default logging configuration passes HTTP 500 server errors to an email log handler; all other log messages are given to a NullHandler.
Default: 'django.utils.log.dictConfig'
A path to a callable that will be used to configure logging in the Django project. Points at a instance of Python’s dictConfig configuration method by default.
If you set LOGGING_CONFIG to None, the logging configuration process will be skipped.
Default: '/accounts/profile/'
The URL where requests are redirected after login when the contrib.auth.login view gets no next parameter.
This is used by the login_required() decorator, for example.
This setting now also accepts view function names and named URL patterns which can be used to reduce configuration duplication since you no longer have to define the URL in two places (settings and URLconf). For backward compatibility reasons the default remains unchanged.
Default: '/accounts/login/'
The URL where requests are redirected for login, especially when using the login_required() decorator.
This setting now also accepts view function names and named URL patterns which can be used to reduce configuration duplication since you no longer have to define the URL in two places (settings and URLconf). For backward compatibility reasons the default remains unchanged.
Default: () (Empty tuple)
A tuple in the same format as ADMINS that specifies who should get broken-link notifications when SEND_BROKEN_LINK_EMAILS is True.
Default: '' (Empty string)
Absolute filesystem path to the directory that will hold user-uploaded files.
Example: "/var/www/example.com/media/"
See also MEDIA_URL.
Default: '' (Empty string)
URL that handles the media served from MEDIA_ROOT, used for managing stored files. It must end in a slash if set to a non-empty value.
Example: "http://media.example.com/"
Default: messages.INFO
Sets the minimum message level that will be recorded by the messages framework. See the messages documentation for more details.
Default: 'django.contrib.messages.storage.fallback.FallbackStorage'
Controls where Django stores message data. See the messages documentation for more details.
Default:
{messages.DEBUG: 'debug',
messages.INFO: 'info',
messages.SUCCESS: 'success',
messages.WARNING: 'warning',
messages.ERROR: 'error',}
Sets the mapping of message levels to message tags. See the messages documentation for more details.
Default:
('django.middleware.common.CommonMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',)
A tuple of middleware classes to use. See Middleware.
Default: 'F j'
The default formatting to use for date fields on Django admin change-list pages – and, possibly, by other parts of the system – in cases when only the month and day are displayed.
For example, when a Django admin change-list page is being filtered by a date drilldown, the header for a given day displays the day and month. Different locales have different formats. For example, U.S. English would say “January 1,” whereas Spanish might say “1 Enero.”
See allowed date format strings. See also DATE_FORMAT, DATETIME_FORMAT, TIME_FORMAT and YEAR_MONTH_FORMAT.
Default: 0
Number of digits grouped together on the integer part of a number.
Common use is to display a thousand separator. If this setting is 0, then no grouping will be applied to the number. If this setting is greater than 0, then THOUSAND_SEPARATOR will be used as the separator between those groups.
Note that if USE_L10N is set to True, then the locale-dictated format has higher precedence and will be applied instead.
See also DECIMAL_SEPARATOR, THOUSAND_SEPARATOR and USE_THOUSAND_SEPARATOR.
See How Django stores passwords.
Default:
('django.contrib.auth.hashers.PBKDF2PasswordHasher',
'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
'django.contrib.auth.hashers.BCryptPasswordHasher',
'django.contrib.auth.hashers.SHA1PasswordHasher',
'django.contrib.auth.hashers.MD5PasswordHasher',
'django.contrib.auth.hashers.UnsaltedMD5PasswordHasher',
'django.contrib.auth.hashers.CryptPasswordHasher',)
Default: 3
The number of days a password reset link is valid for. Used by the django.contrib.auth password reset mechanism.
Default: False
Whether to prepend the “www.” subdomain to URLs that don’t have it. This is only used if CommonMiddleware is installed (see Middleware). See also APPEND_SLASH.
Default: () (Empty tuple)
A tuple of profanities, as strings, that will be forbidden in comments when COMMENTS_ALLOW_PROFANITIES is False.
Default: {}
A dictionary containing settings for the restructuredtext markup filter from the django.contrib.markup application. They override the default writer settings. See the Docutils restructuredtext writer settings docs for details.
Default: Not defined
A string representing the full Python import path to your root URLconf. For example: "mydjangoapps.urls". Can be overridden on a per-request basis by setting the attribute urlconf on the incoming HttpRequest object. See How Django processes a request for details.
Default: '' (Empty string)
A secret key for a particular Django installation. This is used to provide cryptographic signing, and should be set to a unique, unpredictable value.
django-admin.py startproject automatically adds a randomly-generated SECRET_KEY to each new project.
Warning
Keep this value secret.
Running Django with a known SECRET_KEY defeats many of Django’s security protections, and can lead to privilege escalation and remote code execution vulnerabilities.
Default: None
A tuple representing a HTTP header/value combination that signifies a request is secure. This controls the behavior of the request object’s is_secure() method.
This takes some explanation. By default, is_secure() is able to determine whether a request is secure by looking at whether the requested URL uses “https://”. This is important for Django’s CSRF protection, and may be used by your own code or third-party apps.
If your Django app is behind a proxy, though, the proxy may be “swallowing” the fact that a request is HTTPS, using a non-HTTPS connection between the proxy and Django. In this case, is_secure() would always return False – even for requests that were made via HTTPS by the end user.
In this situation, you’ll want to configure your proxy to set a custom HTTP header that tells Django whether the request came in via HTTPS, and you’ll want to set SECURE_PROXY_SSL_HEADER so that Django knows what header to look for.
You’ll need to set a tuple with two elements – the name of the header to look for and the required value. For example:
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
Here, we’re telling Django that we trust the X-Forwarded-Proto header that comes from our proxy, and any time its value is 'https', then the request is guaranteed to be secure (i.e., it originally came in via HTTPS). Obviously, you should only set this setting if you control your proxy or have some other guarantee that it sets/strips this header appropriately.
Note that the header needs to be in the format as used by request.META – all caps and likely starting with HTTP_. (Remember, Django automatically adds 'HTTP_' to the start of x-header names before making the header available in request.META.)
Warning
You will probably open security holes in your site if you set this without knowing what you’re doing. And if you fail to set it when you should. Seriously.
Make sure ALL of the following are true before setting this (assuming the values from the example above):
If any of those are not true, you should keep this setting set to None and find another way of determining HTTPS, perhaps via custom middleware.
Default: False
Whether to send an email to the MANAGERS each time somebody visits a Django-powered page that is 404ed with a non-empty referer (i.e., a broken link). This is only used if CommonMiddleware is installed (see Middleware). See also IGNORABLE_404_URLS and Error reporting.
Default: Not defined.
A dictionary of modules containing serializer definitions (provided as strings), keyed by a string identifier for that serialization type. For example, to define a YAML serializer, use:
SERIALIZATION_MODULES = { 'yaml' : 'path.to.yaml_serializer' }
Default: 'root@localhost'
The email address that error messages come from, such as those sent to ADMINS and MANAGERS.
Default: 1209600 (2 weeks, in seconds)
The age of session cookies, in seconds. See How to use sessions.
Default: None
The domain to use for session cookies. Set this to a string such as ".example.com" for cross-domain cookies, or use None for a standard domain cookie. See the How to use sessions.
Default: True
Whether to use HTTPOnly flag on the session cookie. If this is set to True, client-side JavaScript will not to be able to access the session cookie.
HTTPOnly is a flag included in a Set-Cookie HTTP response header. It is not part of the RFC 2109 standard for cookies, and it isn’t honored consistently by all browsers. However, when it is honored, it can be a useful way to mitigate the risk of client side script accessing the protected cookie data.
Default: 'sessionid'
The name of the cookie to use for sessions. This can be whatever you want (but should be different from LANGUAGE_COOKIE_NAME). See the How to use sessions.
Default: '/'
The path set on the session cookie. This should either match the URL path of your Django installation or be parent of that path.
This is useful if you have multiple Django instances running under the same hostname. They can use different cookie paths, and each instance will only see its own session cookie.
Default: default
If you’re using cache-based session storage, this selects the cache to use.
Default: False
Whether to use a secure cookie for the session cookie. If this is set to True, the cookie will be marked as “secure,” which means browsers may ensure that the cookie is only sent under an HTTPS connection. See the How to use sessions.
Default: django.contrib.sessions.backends.db
Controls where Django stores session data. Valid values are:
See How to use sessions.
Default: False
Whether to expire the session when the user closes his or her browser. See the How to use sessions.
Default: None
If you’re using file-based session storage, this sets the directory in which Django will store session data. See How to use sessions. When the default value (None) is used, Django will use the standard temporary directory for the system.
Default: False
Whether to save the session data on every request. See How to use sessions.
Default: m/d/Y (e.g. 12/31/2003)
An available formatting that can be used for displaying date fields on templates. Note that if USE_L10N is set to True, then the corresponding locale-dictated format has higher precedence and will be applied. See allowed date format strings.
See also DATE_FORMAT and SHORT_DATETIME_FORMAT.
Default: m/d/Y P (e.g. 12/31/2003 4 p.m.)
An available formatting that can be used for displaying datetime fields on templates. Note that if USE_L10N is set to True, then the corresponding locale-dictated format has higher precedence and will be applied. See allowed date format strings.
See also DATE_FORMAT and SHORT_DATE_FORMAT.
Default: ‘django.core.signing.TimestampSigner’
The backend used for signing cookies and other data.
See also the Cryptographic signing documentation.
Default: Not defined
The ID, as an integer, of the current site in the django_site database table. This is used so that application data can hook into specific site(s) and a single database can manage content for multiple sites.
Default: '' (Empty string)
The absolute path to the directory where collectstatic will collect static files for deployment.
Example: "/var/www/example.com/static/"
If the staticfiles contrib app is enabled (default) the collectstatic management command will collect static files into this directory. See the howto on managing static files for more details about usage.
Warning
This should be an (initially empty) destination directory for collecting your static files from their permanent locations into one directory for ease of deployment; it is not a place to store your static files permanently. You should do that in directories that will be found by staticfiles‘s finders, which by default, are 'static/' app sub-directories and any directories you include in STATICFILES_DIRS).
See staticfiles reference and STATIC_URL.
Default: None
URL to use when referring to static files located in STATIC_ROOT.
Example: "/static/" or "http://static.example.com/"
If not None, this will be used as the base path for media definitions and the staticfiles app.
It must end in a slash if set to a non-empty value.
See STATIC_ROOT.
Default:
("django.contrib.auth.context_processors.auth",
"django.core.context_processors.debug",
"django.core.context_processors.i18n",
"django.core.context_processors.media",
"django.core.context_processors.static",
"django.core.context_processors.tz",
"django.contrib.messages.context_processors.messages")
A tuple of callables that are used to populate the context in RequestContext. These callables take a request object as their argument and return a dictionary of items to be merged into the context.
Default: False
A boolean that turns on/off template debug mode. If this is True, the fancy error page will display a detailed report for any exception raised during template rendering. This report contains the relevant snippet of the template, with the appropriate line highlighted.
Note that Django only displays fancy error pages if DEBUG is True, so you’ll want to set that to take advantage of this setting.
See also DEBUG.
Default: () (Empty tuple)
List of locations of the template source files searched by django.template.loaders.filesystem.Loader, in search order.
Note that these paths should use Unix-style forward slashes, even on Windows.
Default:
('django.template.loaders.filesystem.Loader',
'django.template.loaders.app_directories.Loader')
A tuple of template loader classes, specified as strings. Each Loader class knows how to import templates from a particular source. Optionally, a tuple can be used instead of a string. The first item in the tuple should be the Loader‘s module, subsequent items are passed to the Loader during initialization. See The Django template language: For Python programmers.
Default: '' (Empty string)
Output, as a string, that the template system should use for invalid (e.g. misspelled) variables. See How invalid variables are handled..
Default: 'django.test.simple.DjangoTestSuiteRunner'
The name of the class to use for starting the test suite. See Using different testing frameworks.
Default: , (Comma)
Default thousand separator used when formatting numbers. This setting is used only when USE_THOUSAND_SEPARATOR is True and NUMBER_GROUPING is greater than 0.
Note that if USE_L10N is set to True, then the locale-dictated format has higher precedence and will be applied instead.
See also NUMBER_GROUPING, DECIMAL_SEPARATOR and USE_THOUSAND_SEPARATOR.
Default: 'P' (e.g. 4 p.m.)
The default formatting to use for displaying time fields in any part of the system. Note that if USE_L10N is set to True, then the locale-dictated format has higher precedence and will be applied instead. See allowed date format strings.
See also DATE_FORMAT and DATETIME_FORMAT.
Default: ('%H:%M:%S', '%H:%M')
A tuple of formats that will be accepted when inputting data on a time field. Formats will be tried in order, using the first valid one. Note that these format strings use Python’s datetime module syntax, not the format strings from the date Django template tag.
When USE_L10N is True, the locale-dictated format has higher precedence and will be applied instead.
See also DATE_INPUT_FORMATS and DATETIME_INPUT_FORMATS.
Default: 'America/Chicago'
A string representing the time zone for this installation, or None. See available choices. (Note that list of available choices lists more than one on the same line; you’ll want to use just one of the choices for a given time zone. For instance, one line says 'Europe/London GB GB-Eire', but you should use the first bit of that – 'Europe/London' – as your TIME_ZONE setting.)
Note that this isn’t necessarily the time zone of the server. For example, one server may serve multiple Django-powered sites, each with a separate time zone setting.
When USE_TZ is False, this is the time zone in which Django will store all datetimes. When USE_TZ is True, this is the default time zone that Django will use to display datetimes in templates and to interpret datetimes entered in forms.
Django sets the os.environ['TZ'] variable to the time zone you specify in the TIME_ZONE setting. Thus, all your views and models will automatically operate in this time zone. However, Django won’t set the TZ environment variable under the following conditions:
If Django doesn’t set the TZ environment variable, it’s up to you to ensure your processes are running in the correct environment.
Note
Django cannot reliably use alternate time zones in a Windows environment. If you’re running Django on Windows, TIME_ZONE must be set to match the system time zone.
Default: False
Set this to True if you want to disable Django’s transaction management and implement your own.
Default: False
A boolean that specifies whether to output the “Etag” header. This saves bandwidth but slows down performance. This is used by the CommonMiddleware (see Middleware) and in the``Cache Framework`` (see Django’s cache framework).
Default: True
A boolean that specifies whether Django’s translation system should be enabled. This provides an easy way to turn it off, for performance. If this is set to False, Django will make some optimizations so as not to load the translation machinery.
See also LANGUAGE_CODE, USE_L10N and USE_TZ.
Default: False
A boolean that specifies if localized formatting of data will be enabled by default or not. If this is set to True, e.g. Django will display numbers and dates using the format of the current locale.
See also LANGUAGE_CODE, USE_I18N and USE_TZ.
Note
The default settings.py file created by django-admin.py startproject includes USE_L10N = True for convenience.
Default: False
A boolean that specifies whether to display numbers using a thousand separator. When USE_L10N is set to True and if this is also set to True, Django will use the values of THOUSAND_SEPARATOR and NUMBER_GROUPING to format numbers.
See also DECIMAL_SEPARATOR, NUMBER_GROUPING and THOUSAND_SEPARATOR.
Default: False
A boolean that specifies if datetimes will be timezone-aware by default or not. If this is set to True, Django will use timezone-aware datetimes internally. Otherwise, Django will use naive datetimes in local time.
See also TIME_ZONE, USE_I18N and USE_L10N.
Note
The default settings.py file created by django-admin.py startproject includes USE_TZ = True for convenience.
Default: False
A boolean that specifies whether to use the X-Forwarded-Host header in preference to the Host header. This should only be enabled if a proxy which sets this header is in use.
Default: None
The full Python path of the WSGI application object that Django’s built-in servers (e.g. runserver) will use. The django-admin.py startproject management command will create a simple wsgi.py file with an application callable in it, and point this setting to that application.
If not set, the return value of django.core.wsgi.get_wsgi_application() will be used. In this case, the behavior of runserver will be identical to previous Django versions.
Default: 'F Y'
The default formatting to use for date fields on Django admin change-list pages – and, possibly, by other parts of the system – in cases when only the year and month are displayed.
For example, when a Django admin change-list page is being filtered by a date drilldown, the header for a given month displays the month and the year. Different locales have different formats. For example, U.S. English would say “January 2006,” whereas another locale might say “2006/January.”
See allowed date format strings. See also DATE_FORMAT, DATETIME_FORMAT, TIME_FORMAT and MONTH_DAY_FORMAT.
Default: 'SAMEORIGIN'
The default value for the X-Frame-Options header used by XFrameOptionsMiddleware. See the clickjacking protection documentation.
Default: Not defined
The site-specific user profile model used by this site. See User profiles.
Dec 23, 2012