Django Production Settings

How it works

The supplied production module turns on secure cookie and HTTPS settings and uses manifest static storage. HSTS needs a staged policy because mistakes can affect visitors after the initial response; include-subdomains and preload are intentionally not enabled here. A reverse proxy must strip untrusted forwarded headers before the application trusts them. These local configuration checks do not establish that TLS, a proxy or a public domain has been set up correctly.

Run in the supplied local Django project

This lesson uses Django 5.2.18 LTS with Python 3.12. Download the source downloader and run node download-project.mjs http://127.0.0.1:8000 with Node 22 while previewing locally. It creates a new bhylu-django-lab folder and refuses to overwrite an existing one. After deployment, the default base is bhylu.com; until then use your local preview URL.

Inside that new folder, create a virtual environment, install requirements.txt and run the complete lesson file shown below. Every lesson creates a fresh in-memory SQLite database and temporary upload storage. It does not edit the interactive lab’s db.sqlite3 or Bhylu’s database. The visible listing below is the lesson’s core code; its complete downloaded file includes the shared bootstrap.

Django does not run in Bhylu’s current browser playground. No Apache, MySQL or global PHP configuration change is needed. See the setup lesson for the full project and commands.

Example

Run .venv\Scripts\python.exe lessons\production-settings.py from the downloaded project root. Download the complete lesson file; keep it under lessons/. The project’s shared models, forms, views and fixture are prerequisites, not a hidden online runtime.

import importlib
import os
import secrets
os.environ["DJANGO_SECRET_KEY"] = secrets.token_urlsafe(64)
os.environ["DJANGO_ALLOWED_HOSTS"] = "workshops.example.test"
production = importlib.import_module("workshop_site.production")
print(production.DEBUG)
print(production.ALLOWED_HOSTS)
print(production.SESSION_COOKIE_SECURE, production.CSRF_COOKIE_SECURE)

Expected result

False
['workshops.example.test']
True True

The generated secret is never printed, and the module accepts only the explicit fictional host. The actual HTTP lab separately checks a redirect, security headers and blocked hosts. Keep environment setup and application behaviour as separate evidence.