Here’s a list of settings available in Django core and their default values.\nSettings provided by contrib apps are listed below, followed by a topical index\nof the core settings. For introductory material, see the settings topic\nguide.
\nABSOLUTE_URL_OVERRIDESLink to this heading#Default: {} (Empty dictionary)
A dictionary mapping "app_label.model_name" strings to functions that take\na model object and return its URL. This is a way of inserting or overriding\nget_absolute_url() methods on a per-installation basis. Example:
ABSOLUTE_URL_OVERRIDES = {\n 'blogs.blog': lambda o: "/blogs/%s/" % o.slug,\n 'news.story': lambda o: "/stories/%s/%s/" % (o.pub_year, o.slug),\n}\nThe model name used in this setting should be all lowercase, regardless of the\ncase of the actual model class name.
\nADMINSLink to this heading#Default: [] (Empty list)
A list of all the people who get code error notifications. When\nDEBUG=False and AdminEmailHandler\nis configured in LOGGING (done by default), Django emails these\npeople the details of exceptions raised in the request/response cycle.
Each item in the list should be a tuple of (Full name, email address). Example:
\n[('John', 'john@example.com'), ('Mary', 'mary@example.com')]\nALLOWED_HOSTSLink to this heading#Default: [] (Empty list)
A list of strings representing the host/domain names that this Django site can\nserve. This is a security measure to prevent HTTP Host header attacks, which are possible even under many\nseemingly-safe web server configurations.
\nValues in this list can be fully qualified names (e.g. 'www.example.com'),\nin which case they will be matched against the request’s Host header\nexactly (case-insensitive, not including port). A value beginning with a period\ncan be used as a subdomain wildcard: '.example.com' will match\nexample.com, www.example.com, and any other subdomain of\nexample.com. A value of '*' will match anything; in this case you are\nresponsible to provide your own validation of the Host header (perhaps in a\nmiddleware; if so this middleware must be listed first in\nMIDDLEWARE).
Django also allows the fully qualified domain name (FQDN) of any entries.\nSome browsers include a trailing dot in the Host header which Django\nstrips when performing host validation.
If the Host header (or X-Forwarded-Host if\nUSE_X_FORWARDED_HOST is enabled) does not match any value in this\nlist, the django.http.HttpRequest.get_host() method will raise\nSuspiciousOperation.
When DEBUG is True and ALLOWED_HOSTS is empty, the host\nis validated against ['.localhost', '127.0.0.1', '[::1]'].
ALLOWED_HOSTS is also checked when running tests.
This validation only applies via get_host();\nif your code accesses the Host header directly from request.META you\nare bypassing this security protection.
APPEND_SLASHLink to this heading#Default: True
When set to True, if the request URL does not match any of the patterns\nin the URLconf and it doesn’t end in a slash, an HTTP redirect is issued to the\nsame URL with a slash appended. Note that the redirect may cause any data\nsubmitted in a POST request to be lost.
The APPEND_SLASH setting is only used if\nCommonMiddleware is installed\n(see Middleware). See also PREPEND_WWW.
CACHESLink to this heading#Default:
\n{\n 'default': {\n 'BACKEND': 'django.core.cache.backends.locmem.LocMemCache',\n }\n}\nA dictionary containing the settings for all caches to be used with\nDjango. It is a nested dictionary whose contents maps cache aliases\nto a dictionary containing the options for an individual cache.
\nThe CACHES setting must configure a default cache;\nany number of additional caches may also be specified. If you\nare using a cache backend other than the local memory cache, or\nyou need to define multiple caches, other options will be required.\nThe following cache options are available.
BACKENDLink to this heading#Default: '' (Empty string)
The cache backend to use. The built-in cache backends are:
\n'django.core.cache.backends.db.DatabaseCache'
'django.core.cache.backends.dummy.DummyCache'
'django.core.cache.backends.filebased.FileBasedCache'
'django.core.cache.backends.locmem.LocMemCache'
'django.core.cache.backends.memcached.PyMemcacheCache'
'django.core.cache.backends.memcached.PyLibMCCache'
'django.core.cache.backends.redis.RedisCache'
You can use a cache backend that doesn’t ship with Django by setting\nBACKEND to a fully-qualified path of a cache\nbackend class (i.e. mypackage.backends.whatever.WhateverCache).
KEY_FUNCTIONLink to this heading#A string containing a dotted path to a function (or any callable) that defines how to\ncompose a prefix, version and key into a final cache key. The default\nimplementation is equivalent to the function:
\ndef make_key(key, key_prefix, version):\n return ':'.join([key_prefix, str(version), key])\nYou may use any key function you want, as long as it has the same\nargument signature.
\nSee the cache documentation for more\ninformation.
\nKEY_PREFIXLink to this heading#Default: '' (Empty string)
A string that will be automatically included (prepended by default) to\nall cache keys used by the Django server.
\nSee the cache documentation for more information.
\nLOCATIONLink to this heading#Default: '' (Empty string)
The location of the cache to use. This might be the directory for a\nfile system cache, a host and port for a memcache server, or an identifying\nname for a local memory cache. e.g.:
\nCACHES = {\n 'default': {\n 'BACKEND': 'django.core.cache.backends.filebased.FileBasedCache',\n 'LOCATION': '/var/tmp/django_cache',\n }\n}\nOPTIONSLink to this heading#Default: None
Extra parameters to pass to the cache backend. Available parameters\nvary depending on your cache backend.
\nSome information on available parameters can be found in the\ncache arguments documentation. For more information,\nconsult your backend module’s own documentation.
\nTIMEOUTLink to this heading#Default: 300
The number of seconds before a cache entry is considered stale. If the value of\nthis setting is None, cache entries will not expire. A value of 0\ncauses keys to immediately expire (effectively «don’t cache»).
VERSIONLink to this heading#Default: 1
The default version number for cache keys generated by the Django server.
\nSee the cache documentation for more information.
\nCACHE_MIDDLEWARE_ALIASLink to this heading#Default: 'default'
The cache connection to use for the cache middleware.
\nCACHE_MIDDLEWARE_KEY_PREFIXLink to this heading#Default: '' (Empty string)
A string which will be prefixed to the cache keys generated by the cache\nmiddleware. This prefix is combined with the\nKEY_PREFIX setting; it does not replace it.
CACHE_MIDDLEWARE_SECONDSLink to this heading#Default: 600
The default number of seconds to cache a page for the cache middleware.
\n\nCSRF_USE_SESSIONSLink to this heading#Default: False
Whether to store the CSRF token in the user’s session instead of in a cookie.\nIt requires the use of django.contrib.sessions.
Storing the CSRF token in a cookie (Django’s default) is safe, but storing it\nin the session is common practice in other web frameworks and therefore\nsometimes demanded by security auditors.
\nSince the default error views require the CSRF token,\nSessionMiddleware must appear in\nMIDDLEWARE before any middleware that may raise an exception to\ntrigger an error view (such as PermissionDenied)\nif you’re using CSRF_USE_SESSIONS. See Middleware ordering.
CSRF_FAILURE_VIEWLink to this heading#Default: 'django.views.csrf.csrf_failure'
A dotted path to the view function to be used when an incoming request is\nrejected by the CSRF protection. The function should have\nthis signature:
\ndef csrf_failure(request, reason=""):\n ...\nwhere reason is a short message (intended for developers or logging, not\nfor end users) indicating the reason the request was rejected. It should return\nan HttpResponseForbidden.
django.views.csrf.csrf_failure() accepts an additional template_name\nparameter that defaults to '403_csrf.html'. If a template with that name\nexists, it will be used to render the page.
CSRF_HEADER_NAMELink to this heading#Default: 'HTTP_X_CSRFTOKEN'
The name of the request header used for CSRF authentication.
\nAs with other HTTP headers in request.META, the header name received from\nthe server is normalized by converting all characters to uppercase, replacing\nany hyphens with underscores, and adding an 'HTTP_' prefix to the name.\nFor example, if your client sends a 'X-XSRF-TOKEN' header, the setting\nshould be 'HTTP_X_XSRF_TOKEN'.
CSRF_TRUSTED_ORIGINSLink to this heading#Default: [] (Empty list)
A list of trusted origins for unsafe requests (e.g. POST).
For requests that include the Origin header, Django’s CSRF protection\nrequires that header match the origin present in the Host header.
For a secure unsafe\nrequest that doesn’t include the Origin header, the request must have a\nReferer header that matches the origin present in the Host header.
These checks prevent, for example, a POST request from\nsubdomain.example.com from succeeding against api.example.com. If you\nneed cross-origin unsafe requests, continuing the example, add\n'https://subdomain.example.com' to this list (and/or http://... if\nrequests originate from an insecure page).
The setting also supports subdomains, so you could add\n'https://*.example.com', for example, to allow access from all subdomains\nof example.com.
DATABASESLink to this heading#Default: {} (Empty dictionary)
A dictionary containing the settings for all databases to be used with\nDjango. It is a nested dictionary whose contents map a database alias\nto a dictionary containing the options for an individual database.
\nThe DATABASES setting must configure a default database;\nany number of additional databases may also be specified.
The simplest possible settings file is for a single-database setup using\nSQLite. This can be configured using the following:
\nDATABASES = {\n 'default': {\n 'ENGINE': 'django.db.backends.sqlite3',\n 'NAME': 'mydatabase',\n }\n}\nWhen connecting to other database backends, such as MariaDB, MySQL, Oracle, or\nPostgreSQL, additional connection parameters will be required. See\nthe ENGINE setting below on how to specify\nother database types. This example is for PostgreSQL:
DATABASES = {\n 'default': {\n 'ENGINE': 'django.db.backends.postgresql',\n 'NAME': 'mydatabase',\n 'USER': 'mydatabaseuser',\n 'PASSWORD': 'mypassword',\n 'HOST': '127.0.0.1',\n 'PORT': '5432',\n }\n}\nThe following inner options that may be required for more complex\nconfigurations are available:
\nATOMIC_REQUESTSLink to this heading#Default: False
Set this to True to wrap each view in a transaction on this database. See\nTying transactions to HTTP requests.
AUTOCOMMITLink to this heading#Default: True
Set this to False if you want to disable Django’s transaction\nmanagement and implement your own.
ENGINELink to this heading#Default: '' (Empty string)
The database backend to use. The built-in database backends are:
\n'django.db.backends.postgresql'
'django.db.backends.mysql'
'django.db.backends.sqlite3'
'django.db.backends.oracle'
You can use a database backend that doesn’t ship with Django by setting\nENGINE to a fully-qualified path (i.e. mypackage.backends.whatever).
HOSTLink to this heading#Default: '' (Empty string)
Which host to use when connecting to the database. An empty string means\nlocalhost. Not used with SQLite.
\nIf this value starts with a forward slash ('/') and you’re using MySQL,\nMySQL will connect via a Unix socket to the specified socket. For example:
"HOST": '/var/run/mysql'\nIf you’re using MySQL and this value doesn’t start with a forward slash, then\nthis value is assumed to be the host.
\nIf you’re using PostgreSQL, by default (empty HOST), the connection\nto the database is done through UNIX domain sockets (“local” lines in\npg_hba.conf). If your UNIX domain socket is not in the standard location,\nuse the same value of unix_socket_directory from postgresql.conf.\nIf you want to connect through TCP sockets, set HOST to “localhost”\nor “127.0.0.1” (“host” lines in pg_hba.conf).\nOn Windows, you should always define HOST, as UNIX domain sockets\nare not available.
NAMELink to this heading#Default: '' (Empty string)
The name of the database to use. For SQLite, it’s the full path to the database\nfile. When specifying the path, always use forward slashes, even on Windows\n(e.g. C:/homes/user/mysite/sqlite3.db).
CONN_MAX_AGELink to this heading#Default: 0
The lifetime of a database connection, as an integer of seconds. Use 0 to\nclose database connections at the end of each request — Django’s historical\nbehavior — and None for unlimited persistent database connections.
CONN_HEALTH_CHECKSLink to this heading#Default: False
If set to True, existing persistent database connections will be health checked before they are\nreused in each request performing database access. If the health check fails,\nthe connection will be reestablished without failing the request when the\nconnection is no longer usable but the database server is ready to accept and\nserve new connections (e.g. after database server restart closing existing\nconnections).
OPTIONSLink to this heading#Default: {} (Empty dictionary)
Extra parameters to use when connecting to the database. Available parameters\nvary depending on your database backend.
\nSome information on available parameters can be found in the\nDatabase Backends documentation. For more information,\nconsult your backend module’s own documentation.
\nPASSWORDLink to this heading#Default: '' (Empty string)
The password to use when connecting to the database. Not used with SQLite.
\nPORTLink to this heading#Default: '' (Empty string)
The port to use when connecting to the database. An empty string means the\ndefault port. Not used with SQLite.
\nTIME_ZONELink to this heading#Default: None
A string representing the time zone for this database connection or None.\nThis inner option of the DATABASES setting accepts the same values\nas the general TIME_ZONE setting.
When USE_TZ is True and this option is set, reading datetimes\nfrom the database returns aware datetimes in this time zone instead of UTC.\nWhen USE_TZ is False, it is an error to set this option.
If the database backend doesn’t support time zones (e.g. SQLite, MySQL,\nOracle), Django reads and writes datetimes in local time according to this\noption if it is set and in UTC if it isn’t.
\nChanging the connection time zone changes how datetimes are read from and\nwritten to the database.
\nIf Django manages the database and you don’t have a strong reason to do\notherwise, you should leave this option unset. It’s best to store datetimes\nin UTC because it avoids ambiguous or nonexistent datetimes during daylight\nsaving time changes. Also, receiving datetimes in UTC keeps datetime\narithmetic simple — there’s no need to consider potential offset changes\nover a DST transition.
If you’re connecting to a third-party database that stores datetimes in a\nlocal time rather than UTC, then you must set this option to the\nappropriate time zone. Likewise, if Django manages the database but\nthird-party systems connect to the same database and expect to find\ndatetimes in local time, then you must set this option.
If the database backend supports time zones (e.g. PostgreSQL), the\nTIME_ZONE option is very rarely needed. It can be changed at any time;\nthe database takes care of converting datetimes to the desired time zone.
Setting the time zone of the database connection may be useful for running\nraw SQL queries involving date/time functions provided by the database, such\nas date_trunc, because their results depend on the time zone.
However, this has a downside: receiving all datetimes in local time makes\ndatetime arithmetic more tricky — you must account for possible offset\nchanges over DST transitions.
\nConsider converting to local time explicitly with AT TIME ZONE in raw SQL\nqueries instead of setting the TIME_ZONE option.
DISABLE_SERVER_SIDE_CURSORSLink to this heading#Default: False
Set this to True if you want to disable the use of server-side cursors with\nQuerySet.iterator(). Transaction pooling and server-side cursors\ndescribes the use case.
This is a PostgreSQL-specific setting.
\nUSERLink to this heading#Default: '' (Empty string)
The username to use when connecting to the database. Not used with SQLite.
\nTESTLink to this heading#Default: {} (Empty dictionary)
A dictionary of settings for test databases; for more details about the\ncreation and use of test databases, see The test database.
\nHere’s an example with a test database configuration:
\nDATABASES = {\n 'default': {\n 'ENGINE': 'django.db.backends.postgresql',\n 'USER': 'mydatabaseuser',\n 'NAME': 'mydatabase',\n 'TEST': {\n 'NAME': 'mytestdatabase',\n },\n },\n}\nThe following keys in the TEST dictionary are available:
CHARSETLink to this heading#Default: None
The character set encoding used to create the test database. The value of this\nstring is passed directly through to the database, so its format is\nbackend-specific.
\nSupported by the PostgreSQL (postgresql) and MySQL (mysql) backends.
COLLATIONLink to this heading#Default: None
The collation order to use when creating the test database. This value is\npassed directly to the backend, so its format is backend-specific.
\nOnly supported for the mysql backend (see the MySQL manual for details).
DEPENDENCIESLink to this heading#Default: ['default'], for all databases other than default,\nwhich has no dependencies.
The creation-order dependencies of the database. See the documentation\non controlling the creation order of test databases for details.
\nMIGRATELink to this heading#Default: True
When set to False, migrations won’t run when creating the test database.\nThis is similar to setting None as a value in MIGRATION_MODULES,\nbut for all apps.
MIRRORLink to this heading#Default: None
The alias of the database that this database should mirror during\ntesting. It depends on transactions and therefore must be used within\nTransactionTestCase instead of\nTestCase.
This setting exists to allow for testing of primary/replica\n(referred to as master/slave by some databases)\nconfigurations of multiple databases. See the documentation on\ntesting primary/replica configurations for details.
\nNAMELink to this heading#Default: None
The name of database to use when running the test suite.
\nIf the default value (None) is used with the SQLite database engine, the\ntests will use a memory resident database. For all other database engines the\ntest database will use the name 'test_' + DATABASE_NAME.
See The test database.
\nSERIALIZELink to this heading#Boolean value to control whether or not the default test runner serializes the\ndatabase into an in-memory JSON string before running tests (used to restore\nthe database state between tests if you don’t have transactions). You can set\nthis to False to speed up creation time if you don’t have any test classes\nwith serialized_rollback=True.
TEMPLATELink to this heading#This is a PostgreSQL-specific setting.
\nThe name of a template (e.g. 'template0') from which to create the test\ndatabase.
CREATE_DBLink to this heading#Default: True
This is an Oracle-specific setting.
\nIf it is set to False, the test tablespaces won’t be automatically created\nat the beginning of the tests or dropped at the end.
CREATE_USERLink to this heading#Default: True
This is an Oracle-specific setting.
\nIf it is set to False, the test user won’t be automatically created at the\nbeginning of the tests and dropped at the end.
USERLink to this heading#Default: None
This is an Oracle-specific setting.
\nThe username to use when connecting to the Oracle database that will be used\nwhen running tests. If not provided, Django will use 'test_' + USER.
PASSWORDLink to this heading#Default: None
This is an Oracle-specific setting.
\nThe password to use when connecting to the Oracle database that will be used\nwhen running tests. If not provided, Django will generate a random password.
\nORACLE_MANAGED_FILESLink to this heading#Default: False
This is an Oracle-specific setting.
\nIf set to True, Oracle Managed Files (OMF) tablespaces will be used.\nDATAFILE and DATAFILE_TMP will be ignored.
TBLSPACELink to this heading#Default: None
This is an Oracle-specific setting.
\nThe name of the tablespace that will be used when running tests. If not\nprovided, Django will use 'test_' + USER.
TBLSPACE_TMPLink to this heading#Default: None
This is an Oracle-specific setting.
\nThe name of the temporary tablespace that will be used when running tests. If\nnot provided, Django will use 'test_' + USER + '_temp'.
DATAFILELink to this heading#Default: None
This is an Oracle-specific setting.
\nThe name of the datafile to use for the TBLSPACE. If not provided, Django will\nuse TBLSPACE + '.dbf'.
DATAFILE_TMPLink to this heading#Default: None
This is an Oracle-specific setting.
\nThe name of the datafile to use for the TBLSPACE_TMP. If not provided, Django\nwill use TBLSPACE_TMP + '.dbf'.
DATAFILE_MAXSIZELink to this heading#Default: '500M'
This is an Oracle-specific setting.
\nThe maximum size that the DATAFILE is allowed to grow to.
\nDATAFILE_TMP_MAXSIZELink to this heading#Default: '500M'
This is an Oracle-specific setting.
\nThe maximum size that the DATAFILE_TMP is allowed to grow to.
\nDATAFILE_SIZELink to this heading#Default: '50M'
This is an Oracle-specific setting.
\nThe initial size of the DATAFILE.
\nDATAFILE_TMP_SIZELink to this heading#Default: '50M'
This is an Oracle-specific setting.
\nThe initial size of the DATAFILE_TMP.
\nDATAFILE_EXTSIZELink to this heading#Default: '25M'
This is an Oracle-specific setting.
\nThe amount by which the DATAFILE is extended when more space is required.
\nDATAFILE_TMP_EXTSIZELink to this heading#Default: '25M'
This is an Oracle-specific setting.
\nThe amount by which the DATAFILE_TMP is extended when more space is required.
\nDATA_UPLOAD_MAX_MEMORY_SIZELink to this heading#Default: 2621440 (i.e. 2.5 MB).
The maximum size in bytes that a request body may be before a\nSuspiciousOperation (RequestDataTooBig) is\nraised. The check is done when accessing request.body or request.POST\nand is calculated against the total request size excluding any file upload\ndata. You can set this to None to disable the check. Applications that are\nexpected to receive unusually large form posts should tune this setting.
The amount of request data is correlated to the amount of memory needed to\nprocess the request and populate the GET and POST dictionaries. Large requests\ncould be used as a denial-of-service attack vector if left unchecked. Since web\nservers don’t typically perform deep request inspection, it’s not possible to\nperform a similar check at that level.
\nSee also FILE_UPLOAD_MAX_MEMORY_SIZE.
DATA_UPLOAD_MAX_NUMBER_FIELDSLink to this heading#Default: 1000
The maximum number of parameters that may be received via GET or POST before a\nSuspiciousOperation (TooManyFields) is\nraised. You can set this to None to disable the check. Applications that\nare expected to receive an unusually large number of form fields should tune\nthis setting.
The number of request parameters is correlated to the amount of time needed to\nprocess the request and populate the GET and POST dictionaries. Large requests\ncould be used as a denial-of-service attack vector if left unchecked. Since web\nservers don’t typically perform deep request inspection, it’s not possible to\nperform a similar check at that level.
\nDATA_UPLOAD_MAX_NUMBER_FILESLink to this heading#Default: 100
The maximum number of files that may be received via POST in a\nmultipart/form-data encoded request before a\nSuspiciousOperation (TooManyFiles) is\nraised. You can set this to None to disable the check. Applications that\nare expected to receive an unusually large number of file fields should tune\nthis setting.
The number of accepted files is correlated to the amount of time and memory\nneeded to process the request. Large requests could be used as a\ndenial-of-service attack vector if left unchecked. Since web servers don’t\ntypically perform deep request inspection, it’s not possible to perform a\nsimilar check at that level.
\nDATABASE_ROUTERSLink to this heading#Default: [] (Empty list)
The list of routers that will be used to determine which database\nto use when performing a database query.
\nSee the documentation on automatic database routing in multi\ndatabase configurations.
\nDATE_FORMATLink to this heading#Default: 'N j, Y' (e.g. Feb. 4, 2003)
The default formatting to use for displaying date fields in any part of the\nsystem. Note that if USE_L10N is set to True, then the\nlocale-dictated format has higher precedence and will be applied instead. See\nallowed date format strings.
See also DATETIME_FORMAT, TIME_FORMAT and SHORT_DATE_FORMAT.
DATE_INPUT_FORMATSLink to this heading#Default:
\n[\n '%Y-%m-%d', # '2006-10-25'\n '%m/%d/%Y', # '10/25/2006'\n '%m/%d/%y', # '10/25/06'\n '%b %d %Y', # 'Oct 25 2006'\n '%b %d, %Y', # 'Oct 25, 2006'\n '%d %b %Y', # '25 Oct 2006'\n '%d %b, %Y', # '25 Oct, 2006'\n '%B %d %Y', # 'October 25 2006'\n '%B %d, %Y', # 'October 25, 2006'\n '%d %B %Y', # '25 October 2006'\n '%d %B, %Y', # '25 October, 2006'\n]\nA list of formats that will be accepted when inputting data on a date field.\nFormats will be tried in order, using the first valid one. Note that these\nformat strings use Python’s datetime module syntax, not the format strings from the date\ntemplate filter.
When USE_L10N is True, the locale-dictated format has higher\nprecedence and will be applied instead.
See also DATETIME_INPUT_FORMATS and TIME_INPUT_FORMATS.
DATETIME_FORMATLink to this heading#Default: 'N j, Y, P' (e.g. Feb. 4, 2003, 4 p.m.)
The default formatting to use for displaying datetime fields in any part of the\nsystem. Note that if USE_L10N is set to True, then the\nlocale-dictated format has higher precedence and will be applied instead. See\nallowed date format strings.
See also DATE_FORMAT, TIME_FORMAT and SHORT_DATETIME_FORMAT.
DATETIME_INPUT_FORMATSLink to this heading#Default:
\n[\n '%Y-%m-%d %H:%M:%S', # '2006-10-25 14:30:59'\n '%Y-%m-%d %H:%M:%S.%f', # '2006-10-25 14:30:59.000200'\n '%Y-%m-%d %H:%M', # '2006-10-25 14:30'\n '%m/%d/%Y %H:%M:%S', # '10/25/2006 14:30:59'\n '%m/%d/%Y %H:%M:%S.%f', # '10/25/2006 14:30:59.000200'\n '%m/%d/%Y %H:%M', # '10/25/2006 14:30'\n '%m/%d/%y %H:%M:%S', # '10/25/06 14:30:59'\n '%m/%d/%y %H:%M:%S.%f', # '10/25/06 14:30:59.000200'\n '%m/%d/%y %H:%M', # '10/25/06 14:30'\n]\nA list of formats that will be accepted when inputting data on a datetime\nfield. Formats will be tried in order, using the first valid one. Note that\nthese format strings use Python’s datetime module syntax, not the format strings from the date\ntemplate filter. Date-only formats are not included as datetime fields will\nautomatically try DATE_INPUT_FORMATS in last resort.
When USE_L10N is True, the locale-dictated format has higher\nprecedence and will be applied instead.
See also DATE_INPUT_FORMATS and TIME_INPUT_FORMATS.
DEBUGLink to this heading#Default: False
A boolean that turns on/off debug mode.
\nNever deploy a site into production with DEBUG turned on.
One of the main features of debug mode is the display of detailed error pages.\nIf your app raises an exception when DEBUG is True, Django will\ndisplay a detailed traceback, including a lot of metadata about your\nenvironment, such as all the currently defined Django settings (from\nsettings.py).
As a security measure, Django will not include settings that might be\nsensitive, such as SECRET_KEY. Specifically, it will exclude any\nsetting whose name includes any of the following:
'API'
'KEY'
'PASS'
'SECRET'
'SIGNATURE'
'TOKEN'
Note that these are partial matches. 'PASS' will also match PASSWORD,\njust as 'TOKEN' will also match TOKENIZED and so on.
Still, note that there are always going to be sections of your debug output\nthat are inappropriate for public consumption. File paths, configuration\noptions and the like all give attackers extra information about your server.
\nIt is also important to remember that when running with DEBUG\nturned on, Django will remember every SQL query it executes. This is useful\nwhen you’re debugging, but it’ll rapidly consume memory on a production server.
Finally, if DEBUG is False, you also need to properly set\nthe ALLOWED_HOSTS setting. Failing to do so will result in all\nrequests being returned as «Bad Request (400)».
DEBUG_PROPAGATE_EXCEPTIONSLink to this heading#Default: False
If set to True, Django’s exception handling of view functions\n(handler500, or the debug view if DEBUG\nis True) and logging of 500 responses (django.request) is\nskipped and exceptions propagate upward.
This can be useful for some test setups. It shouldn’t be used on a live site\nunless you want your web server (instead of Django) to generate «Internal\nServer Error» responses. In that case, make sure your server doesn’t show the\nstack trace or other sensitive information in the response.
\nDECIMAL_SEPARATORLink to this heading#Default: '.' (Dot)
Default decimal separator used when formatting decimal numbers.
\nNote that if USE_L10N is set to True, then the locale-dictated\nformat has higher precedence and will be applied instead.
See also NUMBER_GROUPING, THOUSAND_SEPARATOR and\nUSE_THOUSAND_SEPARATOR.
DEFAULT_AUTO_FIELDLink to this heading#Default: 'django.db.models.AutoField'
Default primary key field type to use for models that don’t have a field with\nprimary_key=True.
DEFAULT_CHARSETLink to this heading#Default: 'utf-8'
Default charset to use for all HttpResponse objects, if a MIME type isn’t\nmanually specified. Used when constructing the Content-Type header.
DEFAULT_EXCEPTION_REPORTERLink to this heading#Default: 'django.views.debug.ExceptionReporter'
Default exception reporter class to be used if none has been assigned to the\nHttpRequest instance yet. See\nRapporti di errore personalizzati.
DEFAULT_EXCEPTION_REPORTER_FILTERLink to this heading#Default: 'django.views.debug.SafeExceptionReporterFilter'
Default exception reporter filter class to be used if none has been assigned to\nthe HttpRequest instance yet.\nSee Filtering error reports.
DEFAULT_FILE_STORAGELink to this heading#Default: 'django.core.files.storage.FileSystemStorage'
Default file storage class to be used for any file-related operations that don’t\nspecify a particular storage system. See Managing files.
\nDEFAULT_FROM_EMAILLink to this heading#Default: 'webmaster@localhost'
Default email address to use for various automated correspondence from the\nsite manager(s). This doesn’t include error messages sent to ADMINS\nand MANAGERS; for that, see SERVER_EMAIL.
DEFAULT_INDEX_TABLESPACELink to this heading#Default: '' (Empty string)
Default tablespace to use for indexes on fields that don’t specify\none, if the backend supports it (see Tablespaces).
\nDEFAULT_TABLESPACELink to this heading#Default: '' (Empty string)
Default tablespace to use for models that don’t specify one, if the\nbackend supports it (see Tablespaces).
\nDISALLOWED_USER_AGENTSLink to this heading#Default: [] (Empty list)
List of compiled regular expression objects representing User-Agent strings\nthat are not allowed to visit any page, systemwide. Use this for bots/crawlers.\nThis is only used if CommonMiddleware is installed (see\nMiddleware).
EMAIL_BACKENDLink to this heading#Default: 'django.core.mail.backends.smtp.EmailBackend'
The backend to use for sending emails. For the list of available backends see\nSending email.
\nEMAIL_FILE_PATHLink to this heading#Default: Not defined
\nThe directory used by the file email backend\nto store output files.
\nEMAIL_HOSTLink to this heading#Default: 'localhost'
The host to use for sending email.
\nSee also EMAIL_PORT.
EMAIL_HOST_PASSWORDLink to this heading#Default: '' (Empty string)
Password to use for the SMTP server defined in EMAIL_HOST. This\nsetting is used in conjunction with EMAIL_HOST_USER when\nauthenticating to the SMTP server. If either of these settings is empty,\nDjango won’t attempt authentication.
See also EMAIL_HOST_USER.
EMAIL_HOST_USERLink to this heading#Default: '' (Empty string)
Username to use for the SMTP server defined in EMAIL_HOST.\nIf empty, Django won’t attempt authentication.
See also EMAIL_HOST_PASSWORD.
EMAIL_PORTLink to this heading#Default: 25
Port to use for the SMTP server defined in EMAIL_HOST.
EMAIL_SUBJECT_PREFIXLink to this heading#Default: '[Django] '
Subject-line prefix for email messages sent with django.core.mail.mail_admins\nor django.core.mail.mail_managers. You’ll probably want to include the\ntrailing space.
EMAIL_USE_LOCALTIMELink to this heading#Default: False
Whether to send the SMTP Date header of email messages in the local time\nzone (True) or in UTC (False).
EMAIL_USE_TLSLink to this heading#Default: False
Whether to use a TLS (secure) connection when talking to the SMTP server.\nThis is used for explicit TLS connections, generally on port 587. If you are\nexperiencing hanging connections, see the implicit TLS setting\nEMAIL_USE_SSL.
EMAIL_USE_SSLLink to this heading#Default: False
Whether to use an implicit TLS (secure) connection when talking to the SMTP\nserver. In most email documentation this type of TLS connection is referred\nto as SSL. It is generally used on port 465. If you are experiencing problems,\nsee the explicit TLS setting EMAIL_USE_TLS.
Note that EMAIL_USE_TLS/EMAIL_USE_SSL are mutually\nexclusive, so only set one of those settings to True.
EMAIL_SSL_CERTFILELink to this heading#Default: None
If EMAIL_USE_SSL or EMAIL_USE_TLS is True, you can\noptionally specify the path to a PEM-formatted certificate chain file to use\nfor the SSL connection.
EMAIL_SSL_KEYFILELink to this heading#Default: None
If EMAIL_USE_SSL or EMAIL_USE_TLS is True, you can\noptionally specify the path to a PEM-formatted private key file to use for the\nSSL connection.
Note that setting EMAIL_SSL_CERTFILE and EMAIL_SSL_KEYFILE\ndoesn’t result in any certificate checking. They’re passed to the underlying SSL\nconnection. Please refer to the documentation of Python’s\nssl.SSLContext.wrap_socket() function for details on how the\ncertificate chain file and private key file are handled.
EMAIL_TIMEOUTLink to this heading#Default: None
Specifies a timeout in seconds for blocking operations like the connection\nattempt.
\nFILE_UPLOAD_HANDLERSLink to this heading#Default:
\n[\n 'django.core.files.uploadhandler.MemoryFileUploadHandler',\n 'django.core.files.uploadhandler.TemporaryFileUploadHandler',\n]\nA list of handlers to use for uploading. Changing this setting allows complete\ncustomization – even replacement – of Django’s upload process.
\nSee Managing files for details.
\nFILE_UPLOAD_MAX_MEMORY_SIZELink to this heading#Default: 2621440 (i.e. 2.5 MB).
The maximum size (in bytes) that an upload will be before it gets streamed to\nthe file system. See Managing files for details.
\nSee also DATA_UPLOAD_MAX_MEMORY_SIZE.
FILE_UPLOAD_DIRECTORY_PERMISSIONSLink to this heading#Default: None
The numeric mode to apply to directories created in the process of uploading\nfiles.
\nThis setting also determines the default permissions for collected static\ndirectories when using the collectstatic management command. See\ncollectstatic for details on overriding it.
This value mirrors the functionality and caveats of the\nFILE_UPLOAD_PERMISSIONS setting.
FILE_UPLOAD_PERMISSIONSLink to this heading#Default: 0o644
The numeric mode (i.e. 0o644) to set newly uploaded files to. For\nmore information about what these modes mean, see the documentation for\nos.chmod().
If None, you’ll get operating-system dependent behavior. On most platforms,\ntemporary files will have a mode of 0o600, and files saved from memory will\nbe saved using the system’s standard umask.
For security reasons, these permissions aren’t applied to the temporary files\nthat are stored in FILE_UPLOAD_TEMP_DIR.
This setting also determines the default permissions for collected static files\nwhen using the collectstatic management command. See\ncollectstatic for details on overriding it.
FILE_UPLOAD_TEMP_DIRLink to this heading#Default: None
The directory to store data to (typically files larger than\nFILE_UPLOAD_MAX_MEMORY_SIZE) temporarily while uploading files.\nIf None, Django will use the standard temporary directory for the operating\nsystem. For example, this will default to /tmp on *nix-style operating\nsystems.
See Managing files for details.
\nFIRST_DAY_OF_WEEKLink to this heading#Default: 0 (Sunday)
A number representing the first day of the week. This is especially useful\nwhen displaying a calendar. This value is only used when not using\nformat internationalization, or when a format cannot be found for the\ncurrent locale.
\nThe value must be an integer from 0 to 6, where 0 means Sunday, 1 means\nMonday and so on.
\nFIXTURE_DIRSLink to this heading#Default: [] (Empty list)
List of directories searched for fixture files, in addition to the\nfixtures directory of each application, in search order.
Note that these paths should use Unix-style forward slashes, even on Windows.
\n\nFORCE_SCRIPT_NAMELink to this heading#Default: None
If not None, this will be used as the value of the SCRIPT_NAME\nenvironment variable in any HTTP request. This setting can be used to override\nthe server-provided value of SCRIPT_NAME, which may be a rewritten version\nof the preferred value or not supplied at all. It is also used by\ndjango.setup() to set the URL resolver script prefix outside of the\nrequest/response cycle (e.g. in management commands and standalone scripts) to\ngenerate correct URLs when SCRIPT_NAME is not /.
FORM_RENDERERLink to this heading#Default: 'django.forms.renderers.DjangoTemplates'
The class that renders forms and form widgets. It must implement\nthe low-level render API. Included form\nrenderers are:
\n\nFORMAT_MODULE_PATHLink to this heading#Default: None
A full Python path to a Python package that contains custom format definitions\nfor project locales. If not None, Django will check for a formats.py\nfile, under the directory named as the current locale, and will use the\nformats defined in this file.
For example, if FORMAT_MODULE_PATH is set to mysite.formats,\nand current language is en (English), Django will expect a directory tree\nlike:
mysite/\n formats/\n __init__.py\n en/\n __init__.py\n formats.py\nYou can also set this setting to a list of Python paths, for example:
\nFORMAT_MODULE_PATH = [\n 'mysite.formats',\n 'some_app.formats',\n]\nWhen Django searches for a certain format, it will go through all given Python\npaths until it finds a module that actually defines the given format. This\nmeans that formats defined in packages farther up in the list will take\nprecedence over the same formats in packages farther down.
\nAvailable formats are:
\n\nIGNORABLE_404_URLSLink to this heading#Default: [] (Empty list)
List of compiled regular expression objects describing URLs that should be\nignored when reporting HTTP 404 errors via email (see\nCome gestire il report degli errori). Regular expressions are matched against\nrequest's full paths (including\nquery string, if any). Use this if your site does not provide a commonly\nrequested file such as favicon.ico or robots.txt.
This is only used if\nBrokenLinkEmailsMiddleware is enabled (see\nMiddleware).
INSTALLED_APPSLink to this heading#Default: [] (Empty list)
A list of strings designating all applications that are enabled in this\nDjango installation. Each string should be a dotted Python path to:
\nan application configuration class (preferred), or
a package containing an application.
Learn more about application configurations.
\n\n\nWhen several applications provide different versions of the same resource\n(template, static file, management command, translation), the application\nlisted first in INSTALLED_APPS has precedence.
INTERNAL_IPSLink to this heading#Default: [] (Empty list)
A list of IP addresses, as strings, that:
\nAllow the debug() context processor\nto add some variables to the template context.
Can use the admindocs bookmarklets even if\nnot logged in as a staff user.
Are marked as «internal» (as opposed to «EXTERNAL») in\nAdminEmailHandler emails.
LANGUAGE_CODELink to this heading#Default: 'en-us'
A string representing the language code for this installation. This should be in\nstandard language ID format. For example, U.S. English\nis "en-us". See also the list of language identifiers and\nInternationalization and localization.
USE_I18N must be active for this setting to have any effect.
It serves two purposes:
\nIf the locale middleware isn’t in use, it decides which translation is served\nto all users.
If the locale middleware is active, it provides a fallback language in case the\nuser’s preferred language can’t be determined or is not supported by the\nwebsite. It also provides the fallback translation when a translation for a\ngiven literal doesn’t exist for the user’s preferred language.
See How Django discovers language preference for more details.
\nLANGUAGESLink to this heading#Default: A list of all available languages. This list is continually growing\nand including a copy here would inevitably become rapidly out of date. You can\nsee the current list of translated languages by looking in\ndjango/conf/global_settings.py.
\nThe list is a list of two-tuples in the format\n(language code, language name) – for example,\n('ja', 'Japanese').\nThis specifies which languages are available for language selection. See\nInternationalization and localization.
Generally, the default value should suffice. Only set this setting if you want\nto restrict language selection to a subset of the Django-provided languages.
\nIf you define a custom LANGUAGES setting, you can mark the\nlanguage names as translation strings using the\ngettext_lazy() function.
Here’s a sample settings file:
\nfrom django.utils.translation import gettext_lazy as _\n\nLANGUAGES = [\n ('de', _('German')),\n ('en', _('English')),\n]\nLANGUAGES_BIDILink to this heading#Default: A list of all language codes that are written right-to-left. You can\nsee the current list of these languages by looking in\ndjango/conf/global_settings.py.
\nThe list contains language codes for languages that are\nwritten right-to-left.
\nGenerally, the default value should suffice. Only set this setting if you want\nto restrict language selection to a subset of the Django-provided languages.\nIf you define a custom LANGUAGES setting, the list of bidirectional\nlanguages may contain language codes which are not enabled on a given site.
LOCALE_PATHSLink to this heading#Default: [] (Empty list)
A list of directories where Django looks for translation files.\nSee How Django discovers translations.
\nExample:
\nLOCALE_PATHS = [\n '/home/www/project/common_files/locale',\n '/var/local/translations/locale',\n]\nDjango will look within each of these paths for the <locale_code>/LC_MESSAGES\ndirectories containing the actual translation files.
LOGGINGLink to this heading#Default: A logging configuration dictionary.
\nA data structure containing configuration information. When not-empty, the\ncontents of this data structure will be passed as the argument to the\nconfiguration method described in LOGGING_CONFIG.
Among other things, the default logging configuration passes HTTP 500 server\nerrors to an email log handler when DEBUG is False. See also\nConfiguring logging.
You can see the default logging configuration by looking in\ndjango/utils/log.py.
\nLOGGING_CONFIGLink to this heading#Default: 'logging.config.dictConfig'
A path to a callable that will be used to configure logging in the\nDjango project. Points at an instance of Python’s dictConfig configuration method by default.
\nIf you set LOGGING_CONFIG to None, the logging\nconfiguration process will be skipped.
MANAGERSLink to this heading#Default: [] (Empty list)
A list in the same format as ADMINS that specifies who should get\nbroken link notifications when\nBrokenLinkEmailsMiddleware is enabled.
MEDIA_ROOTLink to this heading#Default: '' (Empty string)
Absolute filesystem path to the directory that will hold user-uploaded\nfiles.
\nExample: "/var/www/example.com/media/"
See also MEDIA_URL.
MEDIA_URLLink to this heading#Default: '' (Empty string)
URL that handles the media served from MEDIA_ROOT, used\nfor managing stored files. It must end in a slash if set\nto a non-empty value. You will need to configure these files to be served in both development and production\nenvironments.
If you want to use {{ MEDIA_URL }} in your templates, add\n'django.template.context_processors.media' in the 'context_processors'\noption of TEMPLATES.
Example: "http://media.example.com/"
MIDDLEWARELink to this heading#Default: None
A list of middleware to use. See Middleware.
\nMIGRATION_MODULESLink to this heading#Default: {} (Empty dictionary)
A dictionary specifying the package where migration modules can be found on a\nper-app basis. The default value of this setting is an empty dictionary, but\nthe default package name for migration modules is migrations.
Example:
\n{'blog': 'blog.db_migrations'}\nIn this case, migrations pertaining to the blog app will be contained in\nthe blog.db_migrations package.
If you provide the app_label argument, makemigrations will\nautomatically create the package if it doesn’t already exist.
When you supply None as a value for an app, Django will consider the app as\nan app without migrations regardless of an existing migrations submodule.\nThis can be used, for example, in a test settings file to skip migrations while\ntesting (tables will still be created for the apps” models). To disable\nmigrations for all apps during tests, you can set the\nMIGRATE to False instead. If\nMIGRATION_MODULES is used in your general project settings, remember to use\nthe migrate --run-syncdb option if you want to create tables for the\napp.
MONTH_DAY_FORMATLink to this heading#Default: 'F j'
The default formatting to use for date fields on Django admin change-list\npages – and, possibly, by other parts of the system – in cases when only the\nmonth and day are displayed.
\nFor example, when a Django admin change-list page is being filtered by a date\ndrilldown, the header for a given day displays the day and month. Different\nlocales have different formats. For example, U.S. English would say\n«January 1,» whereas Spanish might say «1 Enero.»
\nNote that if USE_L10N is set to True, then the corresponding\nlocale-dictated format has higher precedence and will be applied.
See allowed date format strings. See also\nDATE_FORMAT, DATETIME_FORMAT,\nTIME_FORMAT and YEAR_MONTH_FORMAT.
NUMBER_GROUPINGLink to this heading#Default: 0
Number of digits grouped together on the integer part of a number.
\nCommon use is to display a thousand separator. If this setting is 0, then\nno grouping will be applied to the number. If this setting is greater than\n0, then THOUSAND_SEPARATOR will be used as the separator between\nthose groups.
Some locales use non-uniform digit grouping, e.g. 10,00,00,000 in\nen_IN. For this case, you can provide a sequence with the number of digit\ngroup sizes to be applied. The first number defines the size of the group\npreceding the decimal delimiter, and each number that follows defines the size\nof preceding groups. If the sequence is terminated with -1, no further\ngrouping is performed. If the sequence terminates with a 0, the last group\nsize is used for the remainder of the number.
Example tuple for en_IN:
NUMBER_GROUPING = (3, 2, 0)\nNote that if USE_L10N is set to True, then the locale-dictated\nformat has higher precedence and will be applied instead.
See also DECIMAL_SEPARATOR, THOUSAND_SEPARATOR and\nUSE_THOUSAND_SEPARATOR.
PREPEND_WWWLink to this heading#Default: False
Whether to prepend the «www.» subdomain to URLs that don’t have it. This is only\nused if CommonMiddleware is installed\n(see Middleware). See also APPEND_SLASH.
ROOT_URLCONFLink to this heading#Default: Not defined
\nA string representing the full Python import path to your root URLconf, for\nexample "mydjangoapps.urls". Can be overridden on a per-request basis by\nsetting the attribute urlconf on the incoming HttpRequest\nobject. See How Django processes a request for details.
SECRET_KEYLink to this heading#Default: '' (Empty string)
A secret key for a particular Django installation. This is used to provide\ncryptographic signing, and should be set to a unique,\nunpredictable value.
\ndjango-admin startproject automatically adds a\nrandomly-generated SECRET_KEY to each new project.
Uses of the key shouldn’t assume that it’s text or bytes. Every use should go\nthrough force_str() or\nforce_bytes() to convert it to the desired type.
Django will refuse to start if SECRET_KEY is not set.
The secret key is used for:
\nAll sessions if you are using\nany other session backend than django.contrib.sessions.backends.cache,\nor are using the default\nget_session_auth_hash().
All messages if you are using\nCookieStorage or\nFallbackStorage.
All PasswordResetView tokens.
Any usage of cryptographic signing, unless a\ndifferent key is provided.
When a secret key is no longer set as SECRET_KEY or contained within\nSECRET_KEY_FALLBACKS all of the above will be invalidated. When\nrotating your secret key, you should move the old key to\nSECRET_KEY_FALLBACKS temporarily. Secret keys are not used for\npasswords of users and key rotation will not affect them.
SECRET_KEY_FALLBACKSLink to this heading#Default: []
A list of fallback secret keys for a particular Django installation. These are\nused to allow rotation of the SECRET_KEY.
In order to rotate your secret keys, set a new SECRET_KEY and move the\nprevious value to the beginning of SECRET_KEY_FALLBACKS. Then remove the\nold values from the end of the SECRET_KEY_FALLBACKS when you are ready to\nexpire the sessions, password reset tokens, and so on, that make use of them.
Uses of the secret key values shouldn’t assume that they are text or bytes.\nEvery use should go through force_str() or\nforce_bytes() to convert it to the desired type.
SECURE_CONTENT_TYPE_NOSNIFFLink to this heading#Default: True
If True, the SecurityMiddleware\nsets the X-Content-Type-Options: nosniff header on all responses that do not\nalready have it.
SECURE_CROSS_ORIGIN_OPENER_POLICYLink to this heading#Default: 'same-origin'
Unless set to None, the\nSecurityMiddleware sets the\nCross-Origin Opener Policy header on all responses that do not already\nhave it to the value provided.
SECURE_HSTS_INCLUDE_SUBDOMAINSLink to this heading#Default: False
If True, the SecurityMiddleware adds\nthe includeSubDomains directive to the HTTP Strict Transport Security\nheader. It has no effect unless SECURE_HSTS_SECONDS is set to a\nnon-zero value.
SECURE_HSTS_PRELOADLink to this heading#Default: False
If True, the SecurityMiddleware adds\nthe preload directive to the HTTP Strict Transport Security\nheader. It has no effect unless SECURE_HSTS_SECONDS is set to a\nnon-zero value.
SECURE_HSTS_SECONDSLink to this heading#Default: 0
If set to a non-zero integer value, the\nSecurityMiddleware sets the\nHTTP Strict Transport Security header on all responses that do not\nalready have it.
SECURE_PROXY_SSL_HEADERLink to this heading#Default: None
A tuple representing an HTTP header/value combination that signifies a request\nis secure. This controls the behavior of the request object’s is_secure()\nmethod.
By default, is_secure() determines if a request is secure by confirming\nthat a requested URL uses https://. This method is important for Django’s\nCSRF protection, and it may be used by your own code or third-party apps.
If your Django app is behind a proxy, though, the proxy may be «swallowing»\nwhether the original request uses HTTPS or not. If there is a non-HTTPS\nconnection between the proxy and Django then is_secure() would always\nreturn False – even for requests that were made via HTTPS by the end user.\nIn contrast, if there is an HTTPS connection between the proxy and Django then\nis_secure() would always return True – even for requests that were\nmade originally via HTTP.
In this situation, configure your proxy to set a custom HTTP header that tells\nDjango whether the request came in via HTTPS, and set\nSECURE_PROXY_SSL_HEADER so that Django knows what header to look for.
Set a tuple with two elements – the name of the header to look for and the\nrequired value. For example:
\nSECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')\nThis tells Django to trust the X-Forwarded-Proto header that comes from our\nproxy and that the request is guaranteed to be secure (i.e., it originally came\nin via HTTPS) when:
the header value is 'https', or
its initial, leftmost value is 'https' in the case of a comma-separated\nlist of protocols (e.g. 'https,http,http').
You should only set this setting if you control your proxy or have some other\nguarantee that it sets/strips this header appropriately.
\nNote that the header needs to be in the format as used by request.META –\nall caps and likely starting with HTTP_. (Remember, Django automatically\nadds 'HTTP_' to the start of x-header names before making the header\navailable in request.META.)
SECURE_REDIRECT_EXEMPTLink to this heading#Default: [] (Empty list)
If a URL path matches a regular expression in this list, the request will not be\nredirected to HTTPS. The\nSecurityMiddleware strips leading slashes\nfrom URL paths, so patterns shouldn’t include them, e.g.\nSECURE_REDIRECT_EXEMPT = [r'^no-ssl/$', …]. If\nSECURE_SSL_REDIRECT is False, this setting has no effect.
SECURE_REFERRER_POLICYLink to this heading#Default: 'same-origin'
If configured, the SecurityMiddleware sets\nthe Referrer Policy header on all responses that do not already have it\nto the value provided.
SECURE_SSL_HOSTLink to this heading#Default: None
If a string (e.g. secure.example.com), all SSL redirects will be directed\nto this host rather than the originally-requested host\n(e.g. www.example.com). If SECURE_SSL_REDIRECT is False, this\nsetting has no effect.
SECURE_SSL_REDIRECTLink to this heading#Default: False
If True, the SecurityMiddleware\nredirects all non-HTTPS requests to HTTPS (except for\nthose URLs matching a regular expression listed in\nSECURE_REDIRECT_EXEMPT).
SERIALIZATION_MODULESLink to this heading#Default: Not defined
\nA dictionary of modules containing serializer definitions (provided as\nstrings), keyed by a string identifier for that serialization type. For\nexample, to define a YAML serializer, use:
\nSERIALIZATION_MODULES = {'yaml': 'path.to.yaml_serializer'}\nSERVER_EMAILLink to this heading#Default: 'root@localhost'
The email address that error messages come from, such as those sent to\nADMINS and MANAGERS.
SHORT_DATE_FORMATLink to this heading#Default: 'm/d/Y' (e.g. 12/31/2003)
An available formatting that can be used for displaying date fields on\ntemplates. Note that if USE_L10N is set to True, then the\ncorresponding locale-dictated format has higher precedence and will be applied.\nSee allowed date format strings.
See also DATE_FORMAT and SHORT_DATETIME_FORMAT.
SHORT_DATETIME_FORMATLink to this heading#Default: 'm/d/Y P' (e.g. 12/31/2003 4 p.m.)
An available formatting that can be used for displaying datetime fields on\ntemplates. Note that if USE_L10N is set to True, then the\ncorresponding locale-dictated format has higher precedence and will be applied.\nSee allowed date format strings.
See also DATE_FORMAT and SHORT_DATE_FORMAT.
SIGNING_BACKENDLink to this heading#Default: 'django.core.signing.TimestampSigner'
The backend used for signing cookies and other data.
\nSee also the Cryptographic signing documentation.
\nSILENCED_SYSTEM_CHECKSLink to this heading#Default: [] (Empty list)
A list of identifiers of messages generated by the system check framework\n(i.e. ["models.W001"]) that you wish to permanently acknowledge and ignore.\nSilenced checks will not be output to the console.
See also the System check framework documentation.
\nTEMPLATESLink to this heading#Default: [] (Empty list)
A list containing the settings for all template engines to be used with\nDjango. Each item of the list is a dictionary containing the options for an\nindividual engine.
\nHere’s a setup that tells the Django template engine to load templates from the\ntemplates subdirectory inside each installed application:
TEMPLATES = [\n {\n 'BACKEND': 'django.template.backends.django.DjangoTemplates',\n 'APP_DIRS': True,\n },\n]\nThe following options are available for all backends.
\nBACKENDLink to this heading#Default: Not defined
\nThe template backend to use. The built-in template backends are:
\n'django.template.backends.django.DjangoTemplates'
'django.template.backends.jinja2.Jinja2'
You can use a template backend that doesn’t ship with Django by setting\nBACKEND to a fully-qualified path (i.e. 'mypackage.whatever.Backend').
NAMELink to this heading#Default: see below
\nThe alias for this particular template engine. It’s an identifier that allows\nselecting an engine for rendering. Aliases must be unique across all\nconfigured template engines.
\nIt defaults to the name of the module defining the engine class, i.e. the\nnext to last piece of BACKEND, when it isn’t\nprovided. For example if the backend is 'mypackage.whatever.Backend' then\nits default name is 'whatever'.
DIRSLink to this heading#Default: [] (Empty list)
Directories where the engine should look for template source files, in search\norder.
\nAPP_DIRSLink to this heading#Default: False
Whether the engine should look for template source files inside installed\napplications.
\n\nOPTIONSLink to this heading#Default: {} (Empty dict)
Extra parameters to pass to the template backend. Available parameters vary\ndepending on the template backend. See\nDjangoTemplates and\nJinja2 for the options of the\nbuilt-in backends.
TEST_RUNNERLink to this heading#Default: 'django.test.runner.DiscoverRunner'
The name of the class to use for starting the test suite. See\nUsing different testing frameworks.
\nTEST_NON_SERIALIZED_APPSLink to this heading#Default: [] (Empty list)
In order to restore the database state between tests for\nTransactionTestCases and database backends without transactions, Django\nwill serialize the contents of all apps\nwhen it starts the test run so it can then reload from that copy before running\ntests that need it.
This slows down the startup time of the test runner; if you have apps that\nyou know don’t need this feature, you can add their full names in here (e.g.\n'django.contrib.contenttypes') to exclude them from this serialization\nprocess.
THOUSAND_SEPARATORLink to this heading#Default: ',' (Comma)
Default thousand separator used when formatting numbers. This setting is\nused only when USE_THOUSAND_SEPARATOR is True and\nNUMBER_GROUPING is greater than 0.
Note that if USE_L10N is set to True, then the locale-dictated\nformat has higher precedence and will be applied instead.
See also NUMBER_GROUPING, DECIMAL_SEPARATOR and\nUSE_THOUSAND_SEPARATOR.
TIME_FORMATLink to this heading#Default: 'P' (e.g. 4 p.m.)
The default formatting to use for displaying time fields in any part of the\nsystem. Note that if USE_L10N is set to True, then the\nlocale-dictated format has higher precedence and will be applied instead. See\nallowed date format strings.
See also DATE_FORMAT and DATETIME_FORMAT.
TIME_INPUT_FORMATSLink to this heading#Default:
\n[\n '%H:%M:%S', # '14:30:59'\n '%H:%M:%S.%f', # '14:30:59.000200'\n '%H:%M', # '14:30'\n]\nA list of formats that will be accepted when inputting data on a time field.\nFormats will be tried in order, using the first valid one. Note that these\nformat strings use Python’s datetime module syntax, not the format strings from the date\ntemplate filter.
When USE_L10N is True, the locale-dictated format has higher\nprecedence and will be applied instead.
See also DATE_INPUT_FORMATS and DATETIME_INPUT_FORMATS.
TIME_ZONELink to this heading#Default: 'America/Chicago'
A string representing the time zone for this installation. See the list of\ntime zones.
\n\nNote that this isn’t necessarily the time zone of the server. For example, one\nserver may serve multiple Django-powered sites, each with a separate time zone\nsetting.
\nWhen USE_TZ is False, this is the time zone in which Django\nwill store all datetimes. When USE_TZ is True, this is the\ndefault time zone that Django will use to display datetimes in templates and\nto interpret datetimes entered in forms.
On Unix environments (where time.tzset() is implemented), Django sets the\nos.environ['TZ'] variable to the time zone you specify in the\nTIME_ZONE setting. Thus, all your views and models will\nautomatically operate in this time zone. However, Django won’t set the TZ\nenvironment variable if you’re using the manual configuration option as\ndescribed in manually configuring settings. If Django doesn’t set the TZ\nenvironment variable, it’s up to you to ensure your processes are running in\nthe correct environment.
USE_DEPRECATED_PYTZLink to this heading#Default: False
A boolean that specifies whether to use pytz, rather than zoneinfo,\nas the default time zone implementation.
USE_I18NLink to this heading#Default: True
A boolean that specifies whether Django’s translation system should be enabled.\nThis provides a way to turn it off, for performance. If this is set to\nFalse, Django will make some optimizations so as not to load the\ntranslation machinery.
See also LANGUAGE_CODE, USE_L10N and USE_TZ.
USE_L10NLink to this heading#Default: True
A boolean that specifies if localized formatting of data will be enabled by\ndefault or not. If this is set to True, e.g. Django will display numbers and\ndates using the format of the current locale.
See also LANGUAGE_CODE, USE_I18N and USE_TZ.
USE_THOUSAND_SEPARATORLink to this heading#Default: False
A boolean that specifies whether to display numbers using a thousand separator.\nWhen set to True and USE_L10N is also True, Django will\nformat numbers using the NUMBER_GROUPING and\nTHOUSAND_SEPARATOR settings. The latter two settings may also be\ndictated by the locale, which takes precedence.
See also DECIMAL_SEPARATOR, NUMBER_GROUPING and\nTHOUSAND_SEPARATOR.
USE_TZLink to this heading#Default: False
A boolean that specifies if datetimes will be timezone-aware by default or not.\nIf this is set to True, Django will use timezone-aware datetimes internally.
When USE_TZ is False, Django will use naive datetimes in local time, except\nwhen parsing ISO 8601 formatted strings, where timezone information will always\nbe retained if present.
USE_X_FORWARDED_HOSTLink to this heading#Default: False
A boolean that specifies whether to use the X-Forwarded-Host header in\npreference to the Host header. This should only be enabled if a proxy\nwhich sets this header is in use.
This setting takes priority over USE_X_FORWARDED_PORT. Per\nRFC 7239 Section 5.3, the X-Forwarded-Host header can include the port\nnumber, in which case you shouldn’t use USE_X_FORWARDED_PORT.
USE_X_FORWARDED_PORTLink to this heading#Default: False
A boolean that specifies whether to use the X-Forwarded-Port header in\npreference to the SERVER_PORT META variable. This should only be\nenabled if a proxy which sets this header is in use.
USE_X_FORWARDED_HOST takes priority over this setting.
WSGI_APPLICATIONLink to this heading#Default: None
The full Python path of the WSGI application object that Django’s built-in\nservers (e.g. runserver) will use. The django-admin\nstartproject management command will create a standard\nwsgi.py file with an application callable in it, and point this setting\nto that application.
If not set, the return value of django.core.wsgi.get_wsgi_application()\nwill be used. In this case, the behavior of runserver will be\nidentical to previous Django versions.
YEAR_MONTH_FORMATLink to this heading#Default: 'F Y'
The default formatting to use for date fields on Django admin change-list\npages – and, possibly, by other parts of the system – in cases when only the\nyear and month are displayed.
\nFor example, when a Django admin change-list page is being filtered by a date\ndrilldown, the header for a given month displays the month and the year.\nDifferent locales have different formats. For example, U.S. English would say\n«January 2006,» whereas another locale might say «2006/January.»
\nNote that if USE_L10N is set to True, then the corresponding\nlocale-dictated format has higher precedence and will be applied.
See allowed date format strings. See also\nDATE_FORMAT, DATETIME_FORMAT, TIME_FORMAT\nand MONTH_DAY_FORMAT.
X_FRAME_OPTIONSLink to this heading#Default: 'DENY'
The default value for the X-Frame-Options header used by\nXFrameOptionsMiddleware. See the\nclickjacking protection documentation.
Settings for django.contrib.auth.
AUTHENTICATION_BACKENDSLink to this heading#Default: ['django.contrib.auth.backends.ModelBackend']
A list of authentication backend classes (as strings) to use when attempting to\nauthenticate a user. See the authentication backends documentation for details.
\nAUTH_USER_MODELLink to this heading#Default: 'auth.User'
The model to use to represent a User. See Substituting a custom User model.
\n\nLOGIN_REDIRECT_URLLink to this heading#Default: '/accounts/profile/'
The URL or named URL pattern where requests are\nredirected after login when the LoginView\ndoesn’t get a next GET parameter.
LOGIN_URLLink to this heading#Default: '/accounts/login/'
The URL or named URL pattern where requests are\nredirected for login when using the\nlogin_required() decorator,\nLoginRequiredMixin, or\nAccessMixin.
LOGOUT_REDIRECT_URLLink to this heading#Default: None
The URL or named URL pattern where requests are\nredirected after logout if LogoutView\ndoesn’t have a next_page attribute.
If None, no redirect will be performed and the logout view will be\nrendered.
PASSWORD_RESET_TIMEOUTLink to this heading#Default: 259200 (3 days, in seconds)
The number of seconds a password reset link is valid for.
\nUsed by the PasswordResetConfirmView.
PASSWORD_HASHERSLink to this heading#See How Django stores passwords.
\nDefault:
\n[\n 'django.contrib.auth.hashers.PBKDF2PasswordHasher',\n 'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',\n 'django.contrib.auth.hashers.Argon2PasswordHasher',\n 'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',\n]\nAUTH_PASSWORD_VALIDATORSLink to this heading#Default: [] (Empty list)
The list of validators that are used to check the strength of user’s passwords.\nSee Password validation for more details. By default, no validation is\nperformed and all passwords are accepted.
\nSettings for django.contrib.messages.
MESSAGE_LEVELLink to this heading#Default: messages.INFO
Sets the minimum message level that will be recorded by the messages\nframework. See message levels for more details.
\n\nMESSAGE_STORAGELink to this heading#Default: 'django.contrib.messages.storage.fallback.FallbackStorage'
Controls where Django stores message data. Valid values are:
\n'django.contrib.messages.storage.fallback.FallbackStorage'
'django.contrib.messages.storage.session.SessionStorage'
'django.contrib.messages.storage.cookie.CookieStorage'
See message storage backends for more details.
\nThe backends that use cookies –\nCookieStorage and\nFallbackStorage –\nuse the value of SESSION_COOKIE_DOMAIN, SESSION_COOKIE_SECURE\nand SESSION_COOKIE_HTTPONLY when setting their cookies.
Settings for django.contrib.sessions.
SESSION_CACHE_ALIASLink to this heading#Default: 'default'
If you’re using cache-based session storage,\nthis selects the cache to use.
\nSESSION_ENGINELink to this heading#Default: 'django.contrib.sessions.backends.db'
Controls where Django stores session data. Included engines are:
\n'django.contrib.sessions.backends.db'
'django.contrib.sessions.backends.file'
'django.contrib.sessions.backends.cache'
'django.contrib.sessions.backends.cached_db'
'django.contrib.sessions.backends.signed_cookies'
See Configuring the session engine for more details.
\nSESSION_EXPIRE_AT_BROWSER_CLOSELink to this heading#Default: False
Whether to expire the session when the user closes their browser. See\nBrowser-length sessions vs. persistent sessions.
\nSESSION_FILE_PATHLink to this heading#Default: None
If you’re using file-based session storage, this sets the directory in\nwhich Django will store session data. When the default value (None) is\nused, Django will use the standard temporary directory for the system.
SESSION_SAVE_EVERY_REQUESTLink to this heading#Default: False
Whether to save the session data on every request. If this is False\n(default), then the session data will only be saved if it has been modified –\nthat is, if any of its dictionary values have been assigned or deleted. Empty\nsessions won’t be created, even if this setting is active.
SESSION_SERIALIZERLink to this heading#Default: 'django.contrib.sessions.serializers.JSONSerializer'
Full import path of a serializer class to use for serializing session data.\nIncluded serializer is:
\n'django.contrib.sessions.serializers.JSONSerializer'
See Session serialization for details.
\nSettings for django.contrib.sites.
SITE_IDLink to this heading#Default: Not defined
\nThe ID, as an integer, of the current site in the django_site database\ntable. This is used so that application data can hook into specific sites\nand a single database can manage content for multiple sites.
Settings for django.contrib.staticfiles.
STATIC_ROOTLink to this heading#Default: None
The absolute path to the directory where collectstatic will collect\nstatic files for deployment.
Example: "/var/www/example.com/static/"
If the staticfiles contrib app is enabled\n(as in the default project template), the collectstatic management\ncommand will collect static files into this directory. See the how-to on\nmanaging static files for more details about\nusage.
STATIC_URLLink to this heading#Default: None
URL to use when referring to static files located in STATIC_ROOT.
Example: "static/" or "http://static.example.com/"
If not None, this will be used as the base path for\nasset definitions (the Media class) and the\nstaticfiles app.
It must end in a slash if set to a non-empty value.
\nYou may need to configure these files to be served in development and will definitely need to do so\nin production.
\n\nSTATICFILES_DIRSLink to this heading#Default: [] (Empty list)
This setting defines the additional locations the staticfiles app will traverse\nif the FileSystemFinder finder is enabled, e.g. if you use the\ncollectstatic or findstatic management command or use the\nstatic file serving view.
This should be set to a list of strings that contain full paths to\nyour additional files directory(ies) e.g.:
\nSTATICFILES_DIRS = [\n "/home/special.polls.com/polls/static",\n "/home/polls.com/polls/static",\n "/opt/webfiles/common",\n]\nNote that these paths should use Unix-style forward slashes, even on Windows\n(e.g. "C:/Users/user/mysite/extra_static_content").
In case you want to refer to files in one of the locations with an additional\nnamespace, you can optionally provide a prefix as (prefix, path)\ntuples, e.g.:
STATICFILES_DIRS = [\n # ...\n ("downloads", "/opt/webfiles/stats"),\n]\nFor example, assuming you have STATIC_URL set to 'static/', the\ncollectstatic management command would collect the «stats» files\nin a 'downloads' subdirectory of STATIC_ROOT.
This would allow you to refer to the local file\n'/opt/webfiles/stats/polls_20101022.tar.gz' with\n'/static/downloads/polls_20101022.tar.gz' in your templates, e.g.:
<a href="{% static 'downloads/polls_20101022.tar.gz' %}">\nSTATICFILES_STORAGELink to this heading#Default: 'django.contrib.staticfiles.storage.StaticFilesStorage'
The file storage engine to use when collecting static files with the\ncollectstatic management command.
A ready-to-use instance of the storage backend defined in this setting\ncan be found at django.contrib.staticfiles.storage.staticfiles_storage.
For an example, see Distribuire file statici da un servizio cloud o da una CDN.
\nSTATICFILES_FINDERSLink to this heading#Default:
\n[\n 'django.contrib.staticfiles.finders.FileSystemFinder',\n 'django.contrib.staticfiles.finders.AppDirectoriesFinder',\n]\nThe list of finder backends that know how to find static files in\nvarious locations.
\nThe default will find files stored in the STATICFILES_DIRS setting\n(using django.contrib.staticfiles.finders.FileSystemFinder) and in a\nstatic subdirectory of each app (using\ndjango.contrib.staticfiles.finders.AppDirectoriesFinder). If multiple\nfiles with the same name are present, the first file that is found will be\nused.
One finder is disabled by default:\ndjango.contrib.staticfiles.finders.DefaultStorageFinder. If added to\nyour STATICFILES_FINDERS setting, it will look for static files in\nthe default file storage as defined by the DEFAULT_FILE_STORAGE\nsetting.
Static file finders are currently considered a private interface, and this\ninterface is thus undocumented.
\ni18n/l10n)Link to this heading#Security
\n\nCross Site Request Forgery Protection
\n\nDatabase: TEST