django/django

Configuration

Django reads configuration from settings, a lazy object backed by DJANGO_SETTINGS_MODULE (or settings.configure(...) for scripts). Defaults live in django/conf/global_settings.py.

This page lists the most important settings, the subsystem that reads them, and a one-line description. The exhaustive reference is docs/ref/settings.txt (rendered at docs.djangoproject.com/en/stable/ref/settings/).

Bootstrapping and identity

Setting	Read by	Default	Notes
`DEBUG`	everywhere	`False`	Turns on the technical 500 page; never use in production
`SECRET_KEY`	signing, sessions, CSRF, password reset, …	`""`	Required; rotating it invalidates signed values
`SECRET_KEY_FALLBACKS`	signing	`[]`	Old keys for graceful rotation
`ALLOWED_HOSTS`	`HttpRequest.get_host()`	`[]`	Required when `DEBUG = False`
`ROOT_URLCONF`	URL resolver	`None`	Required; usually `"<project>.urls"`
`WSGI_APPLICATION`	`runserver`, deployments	`None`	Dotted path to the WSGI callable
`ASGI_APPLICATION`	`runserver` (ASGI), deployments	`None`	Dotted path to the ASGI callable
`INSTALLED_APPS`	apps registry	`[]`	List of dotted paths to app packages or AppConfigs
`MIDDLEWARE`	request handler	`[]`	List of middleware classes (order-sensitive)
`DEFAULT_AUTO_FIELD`	ORM	`"django.db.models.AutoField"`	The default PK type for new models

Database

Setting	Read by	Default	Notes
`DATABASES`	ORM, migrations	`{}`	Dict of connection aliases
`DATABASE_ROUTERS`	ORM	`[]`	List of routers for multi-database setups
`DEFAULT_TABLESPACE`	ORM (Oracle, Postgres)	`""`	Default tablespace name
`DEFAULT_INDEX_TABLESPACE`	ORM	`""`	Default tablespace for indexes
`MIGRATION_MODULES`	migrations loader	`{}`	Override per-app migration package

The DATABASES dict has a known shape:

DATABASES = {
    "default": {
        "ENGINE": "django.db.backends.postgresql",
        "NAME": "...",
        "USER": "...",
        "PASSWORD": "...",
        "HOST": "...",
        "PORT": "...",
        "CONN_MAX_AGE": 0,
        "CONN_HEALTH_CHECKS": True,
        "OPTIONS": {...},
        "TEST": {"NAME": "test_db"},
        "TIME_ZONE": None,
        "ATOMIC_REQUESTS": False,
        "AUTOCOMMIT": True,
    },
}

Templates

Setting	Default	Notes
`TEMPLATES`	`[]`	List of template engine configs
`FORM_RENDERER`	`"django.forms.renderers.DjangoTemplates"`	Form rendering engine

The TEMPLATES list has the shape:

TEMPLATES = [
    {
        "BACKEND": "django.template.backends.django.DjangoTemplates",
        "DIRS": [BASE_DIR / "templates"],
        "APP_DIRS": True,
        "OPTIONS": {
            "context_processors": [...],
            "loaders": [...],
        },
    },
]

Auth

Setting	Default	Notes
`AUTH_USER_MODEL`	`"auth.User"`	The active user model
`AUTHENTICATION_BACKENDS`	`["django.contrib.auth.backends.ModelBackend"]`	Login backend chain
`LOGIN_URL`	`"/accounts/login/"`	Where `@login_required` redirects
`LOGIN_REDIRECT_URL`	`"/accounts/profile/"`	Default post-login URL
`LOGOUT_REDIRECT_URL`	`None`	Where `LogoutView` redirects
`PASSWORD_HASHERS`	(PBKDF2 first, then PBKDF2SHA1, BCryptSHA256, BCrypt, Scrypt, MD5, …)	Order matters; first is default
`AUTH_PASSWORD_VALIDATORS`	`[]`	Validators applied at registration
`PASSWORD_RESET_TIMEOUT`	`259200` (3 days)	Reset link expiry

Sessions

Setting	Default	Notes
`SESSION_ENGINE`	`"django.contrib.sessions.backends.db"`	Storage backend
`SESSION_COOKIE_NAME`	`"sessionid"`	The cookie name
`SESSION_COOKIE_AGE`	`1209600` (2 weeks)	TTL in seconds
`SESSION_COOKIE_SECURE`	`False`	Set to `True` in production HTTPS
`SESSION_COOKIE_HTTPONLY`	`True`	Block JS access
`SESSION_COOKIE_SAMESITE`	`"Lax"`	`"Strict"`/`"Lax"`/`"None"`/`False`
`SESSION_EXPIRE_AT_BROWSER_CLOSE`	`False`	If `True`, ignores `SESSION_COOKIE_AGE`
`SESSION_SAVE_EVERY_REQUEST`	`False`	Refresh expiry on every request

CSRF

Setting	Default	Notes
`CSRF_COOKIE_NAME`	`"csrftoken"`
`CSRF_COOKIE_SECURE`	`False`	Set to `True` in production HTTPS
`CSRF_COOKIE_HTTPONLY`	`False`	False so JS can read; the token is still secret
`CSRF_COOKIE_SAMESITE`	`"Lax"`
`CSRF_TRUSTED_ORIGINS`	`[]`	Required for cross-origin POSTs over HTTPS
`CSRF_USE_SESSIONS`	`False`	Store the token in the session instead of a cookie
`CSRF_HEADER_NAME`	`"HTTP_X_CSRFTOKEN"`	The header `XMLHttpRequest` uses

Static and media files

Setting	Default	Notes
`STATIC_URL`	`None`	URL prefix for static files
`STATIC_ROOT`	`None`	`collectstatic` destination
`STATICFILES_DIRS`	`[]`	Additional source directories
`STATICFILES_FINDERS`	`[FileSystemFinder, AppDirectoriesFinder]`
`STORAGES`	`{"default": ..., "staticfiles": ...}`	Pluggable storage backends
`MEDIA_URL`	`""`	URL prefix for user-uploaded media
`MEDIA_ROOT`	`""`	Filesystem path for media
`FILE_UPLOAD_MAX_MEMORY_SIZE`	`2621440` (2.5 MB)	Larger files spill to disk
`DATA_UPLOAD_MAX_MEMORY_SIZE`	`2621440`	Cap on parsed POST data size
`DATA_UPLOAD_MAX_NUMBER_FIELDS`	`1000`	Cap on form field count
`DATA_UPLOAD_MAX_NUMBER_FILES`	`100`	Cap on uploaded file count

Caching

Setting	Default	Notes
`CACHES`	`{"default": LocMemCache}`	Dict of cache aliases
`CACHE_MIDDLEWARE_ALIAS`	`"default"`	Which cache `CacheMiddleware` uses
`CACHE_MIDDLEWARE_KEY_PREFIX`	`""`
`CACHE_MIDDLEWARE_SECONDS`	`600`

Email

Setting	Default	Notes
`EMAIL_BACKEND`	`"django.core.mail.backends.smtp.EmailBackend"`
`EMAIL_HOST`	`"localhost"`
`EMAIL_PORT`	`25`
`EMAIL_HOST_USER`	`""`
`EMAIL_HOST_PASSWORD`	`""`
`EMAIL_USE_TLS`	`False`
`EMAIL_USE_SSL`	`False`
`DEFAULT_FROM_EMAIL`	`"webmaster@localhost"`	Default `From:` header
`SERVER_EMAIL`	`"root@localhost"`	The `From:` for admin notifications

Internationalisation

Setting	Default	Notes
`LANGUAGE_CODE`	`"en-us"`
`USE_I18N`	`True`	Enable translation framework
`USE_TZ`	`True`	Use timezone-aware datetimes
`TIME_ZONE`	`"America/Chicago"`
`LANGUAGES`	(~80 entries)	Available languages
`LOCALE_PATHS`	`[]`	Additional `<lang>/LC_MESSAGES/` source directories

Security headers

Setting	Default	Notes
`SECURE_HSTS_SECONDS`	`0`	Set to a positive value to enable HSTS
`SECURE_HSTS_INCLUDE_SUBDOMAINS`	`False`
`SECURE_HSTS_PRELOAD`	`False`
`SECURE_SSL_REDIRECT`	`False`	Redirect HTTP → HTTPS
`SECURE_REDIRECT_EXEMPT`	`[]`	URL patterns exempt from redirect
`SECURE_CONTENT_TYPE_NOSNIFF`	`True`	Sets `X-Content-Type-Options: nosniff`
`SECURE_REFERRER_POLICY`	`"same-origin"`
`SECURE_CROSS_ORIGIN_OPENER_POLICY`	`"same-origin"`
`SECURE_CSP`	`{}`	CSP value (added in 6.0)
`SECURE_CSP_REPORT_ONLY`	`{}`	CSP report-only value
`X_FRAME_OPTIONS`	`"DENY"`	For `XFrameOptionsMiddleware`

Logging

Setting	Default	Notes
`LOGGING_CONFIG`	`"logging.config.dictConfig"`	Function called with `LOGGING`
`LOGGING`	(default config)	Logging dict-config
`ADMINS`	`[]`	List of `(name, email)` tuples
`MANAGERS`	`[]`	Same shape; receive `mail_managers`

Test

Setting	Default	Notes
`TEST_RUNNER`	`"django.test.runner.DiscoverRunner"`	Swap-able runner
`FIXTURE_DIRS`	`[]`	Additional fixture search paths

Reading these in code

from django.conf import settings
settings.DEBUG
settings.DATABASES["default"]["ENGINE"]

settings.configure(**overrides) works for scripts that don't have a settings module:

from django.conf import settings
settings.configure(DEBUG=True, INSTALLED_APPS=[...], ...)
import django
django.setup()

Where to look for full descriptions

docs/ref/settings.txt — every setting with a description.
django/conf/global_settings.py — the defaults, with comments.

For background on how settings are loaded and how setting_changed works, see systems/apps-and-settings.

Built by Factory AutoWiki from public repository content. It is a generated preview for codebase exploration, not source-maintained documentation.