Improvements to the security topic

[blighj]

#28592 Had an original ​PR from Daniele, that improved the CSRF documentation, this has since been broken down and merged in smaller PRs. The remaining changes from the original PR do not relate to CSRF, they consist of a new note at the top and rewording of the XSS documentation. These changes can be considered on their own merit, rather than as part of the old ticket.

I've extracted the changes into the attached patch.

[Juan Pedro Roldán]

Hi,

I reviewed this ticket and the attached security_xss.patch as a new contributor looking for documentation-related tasks.

From a reader's perspective, the proposed changes seem useful because they make the XSS section easier to follow. In particular, separating the explanation into shorter paragraphs and listing common XSS scenarios makes the documentation clearer than the current single-paragraph explanation.

I also found the added clarification about Django templates' autoescaping and its limitations helpful, especially the example showing why leaving an HTML attribute unquoted can still be risky.

I don't have enough experience with Django's security documentation to mark this as ready for check-in, but the wording in the patch seems understandable and useful from a new contributor/user perspective.

I hope this review helps with the triage process.

[blighj]

The ticket is not assigned, if you wanted you could take it on, create a PR out of the patch?

[VIZZARD-X]

Thank you for the patch @blighj. I'm open to take this, will be opening a PR for this shortly.

[VIZZARD-X]

The PR is up and ready for review: ​PR

I've created the pull request based on the attached security_xss.patch, thanks to James (@blighj) for the initial patch and for breaking the documentation down so clearly and for others for their reviews.