| 1375 | | .. setting:: SESSION_COOKIE_AGE |
| 1376 | | |
| 1377 | | SESSION_COOKIE_AGE |
| 1378 | | ------------------ |
| 1379 | | |
| 1380 | | Default: ``1209600`` (2 weeks, in seconds) |
| 1381 | | |
| 1382 | | The age of session cookies, in seconds. See :doc:`/topics/http/sessions`. |
| 1383 | | |
| 1384 | | .. setting:: SESSION_COOKIE_DOMAIN |
| 1385 | | |
| 1386 | | SESSION_COOKIE_DOMAIN |
| 1387 | | --------------------- |
| 1388 | | |
| 1389 | | Default: ``None`` |
| 1390 | | |
| 1391 | | The domain to use for session cookies. Set this to a string such as |
| 1392 | | ``".lawrence.com"`` for cross-domain cookies, or use ``None`` for a standard |
| 1393 | | domain cookie. See the :doc:`/topics/http/sessions`. |
| 1394 | | |
| 1395 | | .. setting:: SESSION_COOKIE_HTTPONLY |
| 1396 | | |
| 1397 | | SESSION_COOKIE_HTTPONLY |
| 1398 | | ----------------------- |
| 1399 | | |
| 1400 | | Default: ``False`` |
| 1401 | | |
| 1402 | | Whether to use HTTPOnly flag on the session cookie. If this is set to |
| 1403 | | ``True``, client-side JavaScript will not to be able to access the |
| 1404 | | session cookie. |
| 1405 | | |
| 1406 | | HTTPOnly_ is a flag included in a Set-Cookie HTTP response header. It |
| 1407 | | is not part of the RFC2109 standard for cookies, and it isn't honored |
| 1408 | | consistently by all browsers. However, when it is honored, it can be a |
| 1409 | | useful way to mitigate the risk of client side script accessing the |
| 1410 | | protected cookie data. |
| 1411 | | |
| 1412 | | .. _HTTPOnly: http://www.owasp.org/index.php/HTTPOnly |
| 1413 | | |
| 1414 | | .. setting:: SESSION_COOKIE_NAME |
| 1415 | | |
| 1416 | | SESSION_COOKIE_NAME |
| 1417 | | ------------------- |
| 1418 | | |
| 1419 | | Default: ``'sessionid'`` |
| 1420 | | |
| 1421 | | The name of the cookie to use for sessions. This can be whatever you want (but |
| 1422 | | should be different from ``LANGUAGE_COOKIE_NAME``). See the :doc:`/topics/http/sessions`. |
| 1423 | | |
| 1424 | | .. setting:: SESSION_COOKIE_PATH |
| 1425 | | |
| 1426 | | SESSION_COOKIE_PATH |
| 1427 | | ------------------- |
| 1428 | | |
| 1429 | | .. versionadded:: 1.0 |
| 1430 | | |
| 1431 | | Default: ``'/'`` |
| 1432 | | |
| 1433 | | The path set on the session cookie. This should either match the URL path of your |
| 1434 | | Django installation or be parent of that path. |
| 1435 | | |
| 1436 | | This is useful if you have multiple Django instances running under the same |
| 1437 | | hostname. They can use different cookie paths, and each instance will only see |
| 1438 | | its own session cookie. |
| 1439 | | |
| 1440 | | .. setting:: SESSION_COOKIE_SECURE |
| 1441 | | |
| 1442 | | SESSION_COOKIE_SECURE |
| 1443 | | --------------------- |
| 1444 | | |
| 1445 | | Default: ``False`` |
| 1446 | | |
| 1447 | | Whether to use a secure cookie for the session cookie. If this is set to |
| 1448 | | ``True``, the cookie will be marked as "secure," which means browsers may |
| 1449 | | ensure that the cookie is only sent under an HTTPS connection. |
| 1450 | | See the :doc:`/topics/http/sessions`. |
| 1451 | | |
| 1452 | | .. setting:: SESSION_ENGINE |
| 1453 | | |
| 1454 | | SESSION_ENGINE |
| 1455 | | -------------- |
| 1456 | | |
| 1457 | | .. versionadded:: 1.0 |
| 1458 | | |
| 1459 | | .. versionchanged:: 1.1 |
| 1460 | | The ``cached_db`` backend was added |
| 1461 | | |
| 1462 | | Default: ``django.contrib.sessions.backends.db`` |
| 1463 | | |
| 1464 | | Controls where Django stores session data. Valid values are: |
| 1465 | | |
| 1466 | | * ``'django.contrib.sessions.backends.db'`` |
| 1467 | | * ``'django.contrib.sessions.backends.file'`` |
| 1468 | | * ``'django.contrib.sessions.backends.cache'`` |
| 1469 | | * ``'django.contrib.sessions.backends.cached_db'`` |
| 1470 | | |
| 1471 | | See :doc:`/topics/http/sessions`. |
| 1472 | | |
| 1473 | | .. setting:: SESSION_EXPIRE_AT_BROWSER_CLOSE |
| 1474 | | |
| 1475 | | SESSION_EXPIRE_AT_BROWSER_CLOSE |
| 1476 | | ------------------------------- |
| 1477 | | |
| 1478 | | Default: ``False`` |
| 1479 | | |
| 1480 | | Whether to expire the session when the user closes his or her browser. |
| 1481 | | See the :doc:`/topics/http/sessions`. |
| 1482 | | |
| 1483 | | .. setting:: SESSION_FILE_PATH |
| 1484 | | |
| 1485 | | SESSION_FILE_PATH |
| 1486 | | ----------------- |
| 1487 | | |
| 1488 | | .. versionadded:: 1.0 |
| 1489 | | |
| 1490 | | Default: ``None`` |
| 1491 | | |
| 1492 | | If you're using file-based session storage, this sets the directory in |
| 1493 | | which Django will store session data. See :doc:`/topics/http/sessions`. When |
| 1494 | | the default value (``None``) is used, Django will use the standard temporary |
| 1495 | | directory for the system. |
| 1496 | | |
| 1497 | | .. setting:: SESSION_SAVE_EVERY_REQUEST |
| 1498 | | |
| 1499 | | SESSION_SAVE_EVERY_REQUEST |
| 1500 | | -------------------------- |
| 1501 | | |
| 1502 | | Default: ``False`` |
| 1503 | | |
| 1504 | | Whether to save the session data on every request. See |
| 1505 | | :doc:`/topics/http/sessions`. |
| 1506 | | |
| | 1723 | |
| | 1724 | Contrib settings |
| | 1725 | ================ |
| | 1726 | |
| | 1727 | Settings provided by contrib apps are grouped by app below. |
| | 1728 | |
| | 1729 | Auth |
| | 1730 | ---- |
| | 1731 | |
| | 1732 | Settings for :mod:`django.contrib.auth`. |
| | 1733 | |
| | 1734 | .. setting:: AUTHENTICATION_BACKENDS |
| | 1735 | |
| | 1736 | AUTHENTICATION_BACKENDS |
| | 1737 | ~~~~~~~~~~~~~~~~~~~~~~~ |
| | 1738 | |
| | 1739 | Default: ``('django.contrib.auth.backends.ModelBackend',)`` |
| | 1740 | |
| | 1741 | A tuple of authentication backend classes (as strings) to use when attempting to |
| | 1742 | authenticate a user. See the :doc:`authentication backends documentation |
| | 1743 | </ref/authbackends>` for details. |
| | 1744 | |
| | 1745 | .. _settings-comments: |
| | 1746 | |
| | 1747 | Comments |
| | 1748 | -------- |
| | 1749 | |
| | 1750 | Settings for :mod:`django.contrib.comments`. |
| | 1751 | |
| | 1752 | .. setting:: COMMENT_MAX_LENGTH |
| | 1753 | |
| | 1754 | COMMENT_MAX_LENGTH |
| | 1755 | ~~~~~~~~~~~~~~~~~~ |
| | 1756 | |
| | 1757 | Default: ``3000`` (characters) |
| | 1758 | |
| | 1759 | The maximum length of the comment field, in characters. Comments longer than |
| | 1760 | this will be rejected. |
| | 1761 | |
| | 1762 | .. setting:: COMMENTS_APP |
| | 1763 | |
| | 1764 | COMMENTS_APP |
| | 1765 | ~~~~~~~~~~~~ |
| | 1766 | |
| | 1767 | An app which provides :doc:`customization of the comments framework |
| | 1768 | </ref/contrib/comments/custom>`. Use the same dotted-string notation |
| | 1769 | as in :setting:`INSTALLED_APPS`. Your custom :setting:`COMMENTS_APP` |
| | 1770 | must also be listed in :setting:`INSTALLED_APPS`. |
| | 1771 | |
| | 1772 | .. setting:: COMMENTS_HIDE_REMOVED |
| | 1773 | |
| | 1774 | COMMENTS_HIDE_REMOVED |
| | 1775 | ~~~~~~~~~~~~~~~~~~~~~ |
| | 1776 | |
| | 1777 | Default: ``True`` |
| | 1778 | |
| | 1779 | If ``True``, removed comments will be excluded from comment |
| | 1780 | lists and counts (as taken from template tags). Otherwise, the template author |
| | 1781 | isresponsible for some sort of a "this comment has been removed by the site |
| | 1782 | staff" message. |
| | 1783 | |
| | 1784 | |
| | 1785 | .. _messages-comments: |
| | 1786 | |
| | 1787 | Messages |
| | 1788 | -------- |
| | 1789 | |
| | 1790 | Settings for :mod:`django.contrib.messages`. |
| | 1791 | |
| | 1792 | .. setting:: MESSAGE_LEVEL |
| | 1793 | |
| | 1794 | MESSAGE_LEVEL |
| | 1795 | ~~~~~~~~~~~~~ |
| | 1796 | |
| | 1797 | Default: ``messages.INFO`` |
| | 1798 | |
| | 1799 | This sets the minimum message that will be saved in the message storage. See |
| | 1800 | :ref:`message levels <message-level>` for more details. |
| | 1801 | |
| | 1802 | .. admonition:: Important |
| | 1803 | |
| | 1804 | If you override ``MESSAGE_LEVEL`` in your settings file and rely on any of |
| | 1805 | the built-in constants, you must import the constants module directly to |
| | 1806 | avoid the potential for circular imports, e.g.:: |
| | 1807 | |
| | 1808 | from django.contrib.messages import constants as message_constants |
| | 1809 | MESSAGE_LEVEL = message_constants.DEBUG |
| | 1810 | |
| | 1811 | If desired, you may specify the numeric values for the constants directly |
| | 1812 | according to the values in the :ref:`constants table |
| | 1813 | <message-level-constants>`. |
| | 1814 | |
| | 1815 | .. setting:: MESSAGE_STORAGE |
| | 1816 | |
| | 1817 | MESSAGE_STORAGE |
| | 1818 | ~~~~~~~~~~~~~~~ |
| | 1819 | |
| | 1820 | Default: ``'django.contrib.messages.storage.user_messages.LegacyFallbackStorage'`` |
| | 1821 | |
| | 1822 | Controls where Django stores message data. Valid values are: |
| | 1823 | |
| | 1824 | * ``'django.contrib.messages.storage.fallback.FallbackStorage'`` |
| | 1825 | * ``'django.contrib.messages.storage.session.SessionStorage'`` |
| | 1826 | * ``'django.contrib.messages.storage.cookie.CookieStorage'`` |
| | 1827 | * ``'django.contrib.messages.storage.user_messages.LegacyFallbackStorage'`` |
| | 1828 | |
| | 1829 | See :ref:`message storage backends <message-storage-backends>` for more details. |
| | 1830 | |
| | 1831 | .. setting:: MESSAGE_TAGS |
| | 1832 | |
| | 1833 | MESSAGE_TAGS |
| | 1834 | ~~~~~~~~~~~~ |
| | 1835 | |
| | 1836 | Default:: |
| | 1837 | |
| | 1838 | {messages.DEBUG: 'debug', |
| | 1839 | messages.INFO: 'info', |
| | 1840 | messages.SUCCESS: 'success', |
| | 1841 | messages.WARNING: 'warning', |
| | 1842 | messages.ERROR: 'error',} |
| | 1843 | |
| | 1844 | This sets the mapping of message level to message tag, which is typically |
| | 1845 | rendered as a CSS class in HTML. If you specify a value, it will extend |
| | 1846 | the default. This means you only have to specify those values which you need |
| | 1847 | to override. See :ref:`displaying messages <message-displaying>` for more details. |
| | 1848 | |
| | 1849 | .. admonition:: Important |
| | 1850 | |
| | 1851 | If you override ``MESSAGE_TAGS`` in your settings file and rely on any of |
| | 1852 | the built-in constants, you must import the ``constants`` module directly to |
| | 1853 | avoid the potential for circular imports, e.g.:: |
| | 1854 | |
| | 1855 | from django.contrib.messages import constants as message_constants |
| | 1856 | MESSAGE_TAGS = {message_constants.INFO: ''} |
| | 1857 | |
| | 1858 | If desired, you may specify the numeric values for the constants directly |
| | 1859 | according to the values in the above :ref:`constants table |
| | 1860 | <message-level-constants>`. |
| | 1861 | |
| | 1862 | |
| | 1863 | Sessions |
| | 1864 | -------- |
| | 1865 | |
| | 1866 | Settings for :mod:`django.contrib.sessions`. |
| | 1867 | |
| | 1868 | .. setting:: SESSION_COOKIE_AGE |
| | 1869 | |
| | 1870 | SESSION_COOKIE_AGE |
| | 1871 | ~~~~~~~~~~~~~~~~~~ |
| | 1872 | |
| | 1873 | Default: ``1209600`` (2 weeks, in seconds) |
| | 1874 | |
| | 1875 | The age of session cookies, in seconds. See :doc:`/topics/http/sessions`. |
| | 1876 | |
| | 1877 | .. setting:: SESSION_COOKIE_DOMAIN |
| | 1878 | |
| | 1879 | SESSION_COOKIE_DOMAIN |
| | 1880 | ~~~~~~~~~~~~~~~~~~~~~ |
| | 1881 | |
| | 1882 | Default: ``None`` |
| | 1883 | |
| | 1884 | The domain to use for session cookies. Set this to a string such as |
| | 1885 | ``".lawrence.com"`` for cross-domain cookies, or use ``None`` for a standard |
| | 1886 | domain cookie. See the :doc:`/topics/http/sessions`. |
| | 1887 | |
| | 1888 | .. setting:: SESSION_COOKIE_HTTPONLY |
| | 1889 | |
| | 1890 | SESSION_COOKIE_HTTPONLY |
| | 1891 | ~~~~~~~~~~~~~~~~~~~~~~~ |
| | 1892 | |
| | 1893 | Default: ``False`` |
| | 1894 | |
| | 1895 | Whether to use HTTPOnly flag on the session cookie. If this is set to |
| | 1896 | ``True``, client-side JavaScript will not to be able to access the |
| | 1897 | session cookie. |
| | 1898 | |
| | 1899 | HTTPOnly_ is a flag included in a Set-Cookie HTTP response header. It |
| | 1900 | is not part of the RFC2109 standard for cookies, and it isn't honored |
| | 1901 | consistently by all browsers. However, when it is honored, it can be a |
| | 1902 | useful way to mitigate the risk of client side script accessing the |
| | 1903 | protected cookie data. |
| | 1904 | |
| | 1905 | .. _HTTPOnly: http://www.owasp.org/index.php/HTTPOnly |
| | 1906 | |
| | 1907 | .. setting:: SESSION_COOKIE_NAME |
| | 1908 | |
| | 1909 | SESSION_COOKIE_NAME |
| | 1910 | ~~~~~~~~~~~~~~~~~~~ |
| | 1911 | |
| | 1912 | Default: ``'sessionid'`` |
| | 1913 | |
| | 1914 | The name of the cookie to use for sessions. This can be whatever you want (but |
| | 1915 | should be different from ``LANGUAGE_COOKIE_NAME``). See the :doc:`/topics/http/sessions`. |
| | 1916 | |
| | 1917 | .. setting:: SESSION_COOKIE_PATH |
| | 1918 | |
| | 1919 | SESSION_COOKIE_PATH |
| | 1920 | ~~~~~~~~~~~~~~~~~~~ |
| | 1921 | |
| | 1922 | .. versionadded:: 1.0 |
| | 1923 | |
| | 1924 | Default: ``'/'`` |
| | 1925 | |
| | 1926 | The path set on the session cookie. This should either match the URL path of your |
| | 1927 | Django installation or be parent of that path. |
| | 1928 | |
| | 1929 | This is useful if you have multiple Django instances running under the same |
| | 1930 | hostname. They can use different cookie paths, and each instance will only see |
| | 1931 | its own session cookie. |
| | 1932 | |
| | 1933 | .. setting:: SESSION_COOKIE_SECURE |
| | 1934 | |
| | 1935 | SESSION_COOKIE_SECURE |
| | 1936 | ~~~~~~~~~~~~~~~~~~~~~ |
| | 1937 | |
| | 1938 | Default: ``False`` |
| | 1939 | |
| | 1940 | Whether to use a secure cookie for the session cookie. If this is set to |
| | 1941 | ``True``, the cookie will be marked as "secure," which means browsers may |
| | 1942 | ensure that the cookie is only sent under an HTTPS connection. |
| | 1943 | See the :doc:`/topics/http/sessions`. |
| | 1944 | |
| | 1945 | .. setting:: SESSION_ENGINE |
| | 1946 | |
| | 1947 | SESSION_ENGINE |
| | 1948 | ~~~~~~~~~~~~~~ |
| | 1949 | |
| | 1950 | .. versionadded:: 1.0 |
| | 1951 | |
| | 1952 | .. versionchanged:: 1.1 |
| | 1953 | The ``cached_db`` backend was added |
| | 1954 | |
| | 1955 | Default: ``django.contrib.sessions.backends.db`` |
| | 1956 | |
| | 1957 | Controls where Django stores session data. Valid values are: |
| | 1958 | |
| | 1959 | * ``'django.contrib.sessions.backends.db'`` |
| | 1960 | * ``'django.contrib.sessions.backends.file'`` |
| | 1961 | * ``'django.contrib.sessions.backends.cache'`` |
| | 1962 | * ``'django.contrib.sessions.backends.cached_db'`` |
| | 1963 | |
| | 1964 | See :doc:`/topics/http/sessions`. |
| | 1965 | |
| | 1966 | .. setting:: SESSION_EXPIRE_AT_BROWSER_CLOSE |
| | 1967 | |
| | 1968 | SESSION_EXPIRE_AT_BROWSER_CLOSE |
| | 1969 | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| | 1970 | |
| | 1971 | Default: ``False`` |
| | 1972 | |
| | 1973 | Whether to expire the session when the user closes his or her browser. |
| | 1974 | See the :doc:`/topics/http/sessions`. |
| | 1975 | |
| | 1976 | .. setting:: SESSION_FILE_PATH |
| | 1977 | |
| | 1978 | SESSION_FILE_PATH |
| | 1979 | ~~~~~~~~~~~~~~~~~ |
| | 1980 | |
| | 1981 | .. versionadded:: 1.0 |
| | 1982 | |
| | 1983 | Default: ``None`` |
| | 1984 | |
| | 1985 | If you're using file-based session storage, this sets the directory in |
| | 1986 | which Django will store session data. See :doc:`/topics/http/sessions`. When |
| | 1987 | the default value (``None``) is used, Django will use the standard temporary |
| | 1988 | directory for the system. |
| | 1989 | |
| | 1990 | .. setting:: SESSION_SAVE_EVERY_REQUEST |
| | 1991 | |
| | 1992 | SESSION_SAVE_EVERY_REQUEST |
| | 1993 | ~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| | 1994 | |
| | 1995 | Default: ``False`` |
| | 1996 | |
| | 1997 | Whether to save the session data on every request. See |
| | 1998 | :doc:`/topics/http/sessions`. |
| | 1999 | |
| | 2000 | Sites |
| | 2001 | ----- |
| | 2002 | |
| | 2003 | Settings for :mod:`django.contrib.sites`. |
| | 2004 | |
| | 2005 | .. setting:: SITE_ID |
| | 2006 | |
| | 2007 | SITE_ID |
| | 2008 | ~~~~~~~ |
| | 2009 | |
| | 2010 | Default: Not defined |
| | 2011 | |
| | 2012 | The ID, as an integer, of the current site in the ``django_site`` database |
| | 2013 | table. This is used so that application data can hook into specific sites |
| | 2014 | and a single database can manage content for multiple sites. |
| | 2015 | |
| | 2016 | |