System check framework
The system check framework is a set of static checks for validating Django projects. It detects common problems and provides hints for how to fix them. The framework is extensible so you can easily add your own checks.
For details on how to add your own checks and integrate them with Django’s system checks, see the System check topic guide.
API Reference
CheckMessage
-
class CheckMessage(level, msg, hint, obj=None, id=None)[source]
The warnings and errors raised by system checks must be instances of CheckMessage. An instance encapsulates a single reportable error or warning. It also provides context and hints applicable to the message, and a unique identifier that is used for filtering purposes.
Constructor arguments are:
-
level - The severity of the message. Use one of the predefined values:
DEBUG,INFO,WARNING,ERROR,CRITICAL. If the level is greater or equal toERROR, then Django will prevent management commands from executing. Messages with level lower thanERROR(i.e. warnings) are reported to the console, but can be silenced. -
msg - A short (less than 80 characters) string describing the problem. The string should not contain newlines.
-
hint - A single-line string providing a hint for fixing the problem. If no hint can be provided, or the hint is self-evident from the error message, the hint can be omitted, or a value of
Nonecan be used. -
obj - Optional. An object providing context for the message (for example, the model where the problem was discovered). The object should be a model, field, or manager or any other object that defines
__str__method (on Python 2 you need to define__unicode__method). The method is used while reporting all messages and its result precedes the message. -
id - Optional string. A unique identifier for the issue. Identifiers should follow the pattern
applabel.X001, whereXis one of the lettersCEWID, indicating the message severity (Cfor criticals,Efor errors and so). The number can be allocated by the application, but should be unique within that application.
There are subclasses to make creating messages with common levels easier. When using them you can omit the level argument because it is implied by the class name.
-
class Debug(msg, hint, obj=None, id=None)[source]
-
class Info(msg, hint, obj=None, id=None)[source]
-
class Warning(msg, hint, obj=None, id=None)[source]
-
class Error(msg, hint, obj=None, id=None)[source]
-
class Critical(msg, hint, obj=None, id=None)[source]
Builtin checks
Builtin tags
-
models: Checks governing model, field and manager definitions. -
signals: Checks on signal declarations and handler registrations. -
admin: Checks of any admin site declarations. -
compatibility: Flagging potential problems with version upgrades. -
security: Checks security related configuration. -
templates: Checks template related configuration. -
caches: Checks cache related configuration. -
urls: Checks URL configuration.
Some checks may be registered with multiple tags.
Core system checks
Models
-
models.E001:
<swappable>is not of the formapp_label.app_name. -
models.E002:
<SETTING>references<model>, which has not been installed, or is abstract. -
models.E003: The model has two many-to-many relations through the intermediate model
<app_label>.<model>. -
models.E004:
idcan only be used as a field name if the field also setsprimary_key=True. -
models.E005: The field
<field name>from parent model<model>clashes with the field<field name>from parent model<model>. -
models.E006: The field clashes with the field
<field name>from model<model>. -
models.E007: Field
<field name>has column name<column name>that is used by another field. -
models.E008:
index_togethermust be a list or tuple. -
models.E009: All
index_togetherelements must be lists or tuples. -
models.E010:
unique_togethermust be a list or tuple. -
models.E011: All
unique_togetherelements must be lists or tuples. -
models.E012:
index_together/unique_togetherrefers to the non-existent field<field name>. -
models.E013:
index_together/unique_togetherrefers to aManyToManyField<field name>, butManyToManyFields are not supported for that option. -
models.E014:
orderingmust be a tuple or list (even if you want to order by only one field). -
models.E015:
orderingrefers to the non-existent field<field name>. -
models.E016:
index_together/unique_togetherrefers to field<field_name>which is not local to model<model>. -
models.E017: Proxy model
<model>contains model fields. -
models.E018: Autogenerated column name too long for field
<field>. Maximum length is<maximum length>for database<alias>. -
models.E019: Autogenerated column name too long for M2M field
<M2M field>. Maximum length is<maximum length>for database<alias>. -
models.E020: The
<model>.check()class method is currently overridden. -
models.E021:
orderingandorder_with_respect_tocannot be used together.
Fields
- fields.E001: Field names must not end with an underscore.
-
fields.E002: Field names must not contain
"__". -
fields.E003:
pkis a reserved word that cannot be used as a field name. -
fields.E004:
choicesmust be an iterable (e.g., a list or tuple). -
fields.E005:
choicesmust be an iterable returning(actual value, human readable name)tuples. -
fields.E006:
db_indexmust beNone,TrueorFalse. -
fields.E007: Primary keys must not have
null=True. -
fields.E100:
AutoFields must set primary_key=True. -
fields.E110:
BooleanFields do not accept null values. -
fields.E120:
CharFields must define amax_lengthattribute. -
fields.E121:
max_lengthmust be a positive integer. -
fields.W122:
max_lengthis ignored when used withIntegerField. -
fields.E130:
DecimalFields must define adecimal_placesattribute. -
fields.E131:
decimal_placesmust be a non-negative integer. -
fields.E132:
DecimalFields must define amax_digitsattribute. -
fields.E133:
max_digitsmust be a non-negative integer. -
fields.E134:
max_digitsmust be greater or equal todecimal_places. -
fields.E140:
FilePathFields must have eitherallow_filesorallow_foldersset to True. -
fields.E150:
GenericIPAddressFields cannot accept blank values if null values are not allowed, as blank values are stored as nulls. -
fields.E160: The options
auto_now,auto_now_add, anddefaultare mutually exclusive. Only one of these options may be present. - fields.W161: Fixed default value provided.
-
fields.E900:
IPAddressFieldhas been removed except for support in historical migrations. -
fields.W900:
IPAddressFieldhas been deprecated. Support for it (except in historical migrations) will be removed in Django 1.9. This check appeared in Django 1.7 and 1.8.
File Fields
-
fields.E200:
uniqueis not a valid argument for aFileField. -
fields.E201:
primary_keyis not a valid argument for aFileField. -
fields.E210: Cannot use
ImageFieldbecause Pillow is not installed.
Related Fields
-
fields.E300: Field defines a relation with model
<model>, which is either not installed, or is abstract. -
fields.E301: Field defines a relation with the model
<model>which has been swapped out. -
fields.E302: Accessor for field
<field name>clashes with field<field name>. -
fields.E303: Reverse query name for field
<field name>clashes with field<field name>. -
fields.E304: Field name
<field name>clashes with accessor for<field name>. -
fields.E305: Field name
<field name>clashes with reverse query name for<field name>. -
fields.E306: Related name must be a valid Python identifier or end with a
'+'. -
fields.E310: No subset of the fields
<field1>,<field2>, ... on model<model>is unique. Addunique=Trueon any of those fields or add at least a subset of them to a unique_together constraint. -
fields.E311:
<model>must setunique=Truebecause it is referenced by aForeignKey. -
fields.E320: Field specifies
on_delete=SET_NULL, but cannot be null. -
fields.E321: The field specifies
on_delete=SET_DEFAULT, but has no default value. -
fields.E330:
ManyToManyFields cannot be unique. -
fields.E331: Field specifies a many-to-many relation through model
<model>, which has not been installed. - fields.E332: Many-to-many fields with intermediate tables must not be symmetrical.
-
fields.E333: The model is used as an intermediate model by
<model>, but it has more than two foreign keys to<model>, which is ambiguous. You must specify which two foreign keys Django should use via thethrough_fieldskeyword argument. -
fields.E334: The model is used as an intermediate model by
<model>, but it has more than one foreign key from<model>, which is ambiguous. You must specify which foreign key Django should use via thethrough_fieldskeyword argument. -
fields.E335: The model is used as an intermediate model by
<model>, but it has more than one foreign key to<model>, which is ambiguous. You must specify which foreign key Django should use via thethrough_fieldskeyword argument. -
fields.E336: The model is used as an intermediary model by
<model>, but it does not have foreign key to<model>or<model>. -
fields.E337: Field specifies
through_fieldsbut does not provide the names of the two link fields that should be used for the relation through<model>. -
fields.E338: The intermediary model
<through model>has no field<field name>. -
fields.E339:
<model>.<field name>is not a foreign key to<model>. -
fields.W340:
nullhas no effect onManyToManyField. -
fields.W341:
ManyToManyFielddoes not supportvalidators. -
fields.W342: Setting
unique=Trueon aForeignKeyhas the same effect as using aOneToOneField.
Signals
-
signals.E001:
<handler>was connected to the<signal>signal with a lazy reference to the<model>sender, which has not been installed.
Backwards Compatibility
The following checks are performed to warn the user of any potential problems that might occur as a result of a version upgrade.
- 1_6.W001: Some project unit tests may not execute as expected. This check was removed in Django 1.8 due to false positives.
-
1_6.W002:
BooleanFielddoes not have a default value. This check was removed in Django 1.8 due to false positives. -
1_7.W001: Django 1.7 changed the global defaults for the
MIDDLEWARE_CLASSES.django.contrib.sessions.middleware.SessionMiddleware,django.contrib.auth.middleware.AuthenticationMiddleware, anddjango.contrib.messages.middleware.MessageMiddlewarewere removed from the defaults. If your project needs these middleware then you should configure this setting. This check was removed in Django 1.9. -
1_8.W001: The standalone
TEMPLATE_*settings were deprecated in Django 1.8 and theTEMPLATESdictionary takes precedence. You must put the values of the following settings into your defaultsTEMPLATESdict:TEMPLATE_DIRS,ALLOWED_INCLUDE_ROOTS,TEMPLATE_CONTEXT_PROCESSORS,TEMPLATE_DEBUG,TEMPLATE_LOADERS,TEMPLATE_STRING_IF_INVALID.
Admin
Admin checks are all performed as part of the admin tag.
The following checks are performed on any ModelAdmin (or subclass) that is registered with the admin site:
-
admin.E001: The value of
raw_id_fieldsmust be a list or tuple. -
admin.E002: The value of
raw_id_fields[n]refers to<field name>, which is not an attribute of<model>. -
admin.E003: The value of
raw_id_fields[n]must be aForeignKeyorManyToManyField. -
admin.E004: The value of
fieldsmust be a list or tuple. -
admin.E005: Both
fieldsetsandfieldsare specified. -
admin.E006: The value of
fieldscontains duplicate field(s). -
admin.E007: The value of
fieldsetsmust be a list or tuple. -
admin.E008: The value of
fieldsets[n]must be a list or tuple. -
admin.E009: The value of
fieldsets[n]must be of length 2. -
admin.E010: The value of
fieldsets[n][1]must be a dictionary. -
admin.E011: The value of
fieldsets[n][1]must contain the keyfields. -
admin.E012: There are duplicate field(s) in
fieldsets[n][1]. -
admin.E013:
fields[n]/fieldsets[n][m]cannot include theManyToManyField<field name>, because that field manually specifies a relationship model. -
admin.E014: The value of
excludemust be a list or tuple. -
admin.E015: The value of
excludecontains duplicate field(s). -
admin.E016: The value of
formmust inherit fromBaseModelForm. -
admin.E017: The value of
filter_verticalmust be a list or tuple. -
admin.E018: The value of
filter_horizontalmust be a list or tuple. -
admin.E019: The value of
filter_vertical[n]/filter_vertical[n]refers to<field name>, which is not an attribute of<model>. -
admin.E020: The value of
filter_vertical[n]/filter_vertical[n]must be aManyToManyField. -
admin.E021: The value of
radio_fieldsmust be a dictionary. -
admin.E022: The value of
radio_fieldsrefers to<field name>, which is not an attribute of<model>. -
admin.E023: The value of
radio_fieldsrefers to<field name>, which is not aForeignKey, and does not have achoicesdefinition. -
admin.E024: The value of
radio_fields[<field name>]must be eitheradmin.HORIZONTALoradmin.VERTICAL. -
admin.E025: The value of
view_on_sitemust be either a callable or a boolean value. -
admin.E026: The value of
prepopulated_fieldsmust be a dictionary. -
admin.E027: The value of
prepopulated_fieldsrefers to<field name>, which is not an attribute of<model>. -
admin.E028: The value of
prepopulated_fieldsrefers to<field name>, which must not be aDateTimeField,ForeignKeyorManyToManyField. -
admin.E029: The value of
prepopulated_fields[<field name>]must be a list or tuple. -
admin.E030: The value of
prepopulated_fieldsrefers to<field name>, which is not an attribute of<model>. -
admin.E031: The value of
orderingmust be a list or tuple. -
admin.E032: The value of
orderinghas the random ordering marker?, but contains other fields as well. -
admin.E033: The value of
orderingrefers to<field name>, which is not an attribute of<model>. -
admin.E034: The value of
readonly_fieldsmust be a list or tuple. -
admin.E035: The value of
readonly_fields[n]is not a callable, an attribute of<ModelAdmin class>, or an attribute of<model>.
ModelAdmin
The following checks are performed on any ModelAdmin that is registered with the admin site:
-
admin.E101: The value of
save_asmust be a boolean. -
admin.E102: The value of
save_on_topmust be a boolean. -
admin.E103: The value of
inlinesmust be a list or tuple. -
admin.E104:
<InlineModelAdmin class>must inherit fromBaseModelAdmin. -
admin.E105:
<InlineModelAdmin class>must have amodelattribute. -
admin.E106: The value of
<InlineModelAdmin class>.modelmust be aModel. -
admin.E107: The value of
list_displaymust be a list or tuple. -
admin.E108: The value of
list_display[n]refers to<label>, which is not a callable, an attribute of<ModelAdmin class>, or an attribute or method on<model>. -
admin.E109: The value of
list_display[n]must not be aManyToManyField. -
admin.E110: The value of
list_display_linksmust be a list, a tuple, orNone. -
admin.E111: The value of
list_display_links[n]refers to<label>, which is not defined inlist_display. -
admin.E112: The value of
list_filtermust be a list or tuple. -
admin.E113: The value of
list_filter[n]must inherit fromListFilter. -
admin.E114: The value of
list_filter[n]must not inherit fromFieldListFilter. -
admin.E115: The value of
list_filter[n][1]must inherit fromFieldListFilter. -
admin.E116: The value of
list_filter[n]refers to<label>, which does not refer to a Field. -
admin.E117: The value of
list_select_relatedmust be a boolean, tuple or list. -
admin.E118: The value of
list_per_pagemust be an integer. -
admin.E119: The value of
list_max_show_allmust be an integer. -
admin.E120: The value of
list_editablemust be a list or tuple. -
admin.E121: The value of
list_editable[n]refers to<label>, which is not an attribute of<model>. -
admin.E122: The value of
list_editable[n]refers to<label>, which is not contained inlist_display. -
admin.E123: The value of
list_editable[n]cannot be in bothlist_editableandlist_display_links. -
admin.E124: The value of
list_editable[n]refers to the first field inlist_display(<label>), which cannot be used unlesslist_display_linksis set. -
admin.E125: The value of
list_editable[n]refers to<field name>, which is not editable through the admin. -
admin.E126: The value of
search_fieldsmust be a list or tuple. -
admin.E127: The value of
date_hierarchyrefers to<field name>, which is not an attribute of<model>. -
admin.E128: The value of
date_hierarchymust be aDateFieldorDateTimeField.
InlineModelAdmin
The following checks are performed on any InlineModelAdmin that is registered as an inline on a ModelAdmin.
-
admin.E201: Cannot exclude the field
<field name>, because it is the foreign key to the parent model<app_label>.<model>. -
admin.E202:
<model>has noForeignKeyto<parent model>./<model>has more than oneForeignKeyto<parent model>. -
admin.E203: The value of
extramust be an integer. -
admin.E204: The value of
max_nummust be an integer. -
admin.E205: The value of
min_nummust be an integer. -
admin.E206: The value of
formsetmust inherit fromBaseModelFormSet.
GenericInlineModelAdmin
The following checks are performed on any GenericInlineModelAdmin that is registered as an inline on a ModelAdmin.
-
admin.E301:
'ct_field'references<label>, which is not a field on<model>. -
admin.E302:
'ct_fk_field'references<label>, which is not a field on<model>. -
admin.E303:
<model>has noGenericForeignKey. -
admin.E304:
<model>has noGenericForeignKeyusing content type field<field name>and object ID field<field name>.
Auth
-
auth.E001:
REQUIRED_FIELDSmust be a list or tuple. -
auth.E002: The field named as the
USERNAME_FIELDfor a custom user model must not be included inREQUIRED_FIELDS. -
auth.E003:
<field>must be unique because it is named as theUSERNAME_FIELD. -
auth.W004:
<field>is named as theUSERNAME_FIELD, but it is not unique.
Content Types
The following checks are performed when a model contains a GenericForeignKey or GenericRelation:
-
contenttypes.E001: The
GenericForeignKeyobject ID references the non-existent field<field>. -
contenttypes.E002: The
GenericForeignKeycontent type references the non-existent field<field>. -
contenttypes.E003:
<field>is not aForeignKey. -
contenttypes.E004:
<field>is not aForeignKeytocontenttypes.ContentType.
Security
The security checks do not make your site secure. They do not audit code, do intrusion detection, or do anything particularly complex. Rather, they help perform an automated, low-hanging-fruit checklist. They help you remember the simple things that improve your site’s security.
Some of these checks may not be appropriate for your particular deployment configuration. For instance, if you do your HTTP to HTTPS redirection in a load balancer, it’d be irritating to be constantly warned about not having enabled SECURE_SSL_REDIRECT. Use SILENCED_SYSTEM_CHECKS to silence unneeded checks.
The following checks are run if you use the check --deploy option:
-
security.W001: You do not have
django.middleware.security.SecurityMiddlewarein yourMIDDLEWARE_CLASSESso theSECURE_HSTS_SECONDS,SECURE_CONTENT_TYPE_NOSNIFF,SECURE_BROWSER_XSS_FILTER, andSECURE_SSL_REDIRECTsettings will have no effect. -
security.W002: You do not have
django.middleware.clickjacking.XFrameOptionsMiddlewarein yourMIDDLEWARE_CLASSES, so your pages will not be served with an'x-frame-options'header. Unless there is a good reason for your site to be served in a frame, you should consider enabling this header to help prevent clickjacking attacks. -
security.W003: You don’t appear to be using Django’s built-in cross-site request forgery protection via the middleware (
django.middleware.csrf.CsrfViewMiddlewareis not in yourMIDDLEWARE_CLASSES). Enabling the middleware is the safest approach to ensure you don’t leave any holes. -
security.W004: You have not set a value for the
SECURE_HSTS_SECONDSsetting. If your entire site is served only over SSL, you may want to consider setting a value and enabling HTTP Strict Transport Security. Be sure to read the documentation first; enabling HSTS carelessly can cause serious, irreversible problems. -
security.W005: You have not set the
SECURE_HSTS_INCLUDE_SUBDOMAINSsetting toTrue. Without this, your site is potentially vulnerable to attack via an insecure connection to a subdomain. Only set this toTrueif you are certain that all subdomains of your domain should be served exclusively via SSL. -
security.W006: Your
SECURE_CONTENT_TYPE_NOSNIFFsetting is not set toTrue, so your pages will not be served with an'x-content-type-options: nosniff'header. You should consider enabling this header to prevent the browser from identifying content types incorrectly. -
security.W007: Your
SECURE_BROWSER_XSS_FILTERsetting is not set toTrue, so your pages will not be served with an'x-xss-protection: 1; mode=block'header. You should consider enabling this header to activate the browser’s XSS filtering and help prevent XSS attacks. -
security.W008: Your
SECURE_SSL_REDIRECTsetting is not set toTrue. Unless your site should be available over both SSL and non-SSL connections, you may want to either set this setting toTrueor configure a load balancer or reverse-proxy server to redirect all connections to HTTPS. -
security.W009: Your
SECRET_KEYhas less than 50 characters or less than 5 unique characters. Please generate a long and randomSECRET_KEY, otherwise many of Django’s security-critical features will be vulnerable to attack. -
security.W010: You have
django.contrib.sessionsin yourINSTALLED_APPSbut you have not setSESSION_COOKIE_SECUREtoTrue. Using a secure-only session cookie makes it more difficult for network traffic sniffers to hijack user sessions. -
security.W011: You have
django.contrib.sessions.middleware.SessionMiddlewarein yourMIDDLEWARE_CLASSES, but you have not setSESSION_COOKIE_SECUREtoTrue. Using a secure-only session cookie makes it more difficult for network traffic sniffers to hijack user sessions. -
security.W012:
SESSION_COOKIE_SECUREis not set toTrue. Using a secure-only session cookie makes it more difficult for network traffic sniffers to hijack user sessions. -
security.W013: You have
django.contrib.sessionsin yourINSTALLED_APPS, but you have not setSESSION_COOKIE_HTTPONLYtoTrue. Using anHttpOnlysession cookie makes it more difficult for cross-site scripting attacks to hijack user sessions. -
security.W014: You have
django.contrib.sessions.middleware.SessionMiddlewarein yourMIDDLEWARE_CLASSES, but you have not setSESSION_COOKIE_HTTPONLYtoTrue. Using anHttpOnlysession cookie makes it more difficult for cross-site scripting attacks to hijack user sessions. -
security.W015:
SESSION_COOKIE_HTTPONLYis not set toTrue. Using anHttpOnlysession cookie makes it more difficult for cross-site scripting attacks to hijack user sessions. -
security.W016:
CSRF_COOKIE_SECUREis not set toTrue. Using a secure-only CSRF cookie makes it more difficult for network traffic sniffers to steal the CSRF token. -
security.W017:
CSRF_COOKIE_HTTPONLYis not set toTrue. Using anHttpOnlyCSRF cookie makes it more difficult for cross-site scripting attacks to steal the CSRF token. -
security.W018: You should not have
DEBUGset toTruein deployment. -
security.W019: You have
django.middleware.clickjacking.XFrameOptionsMiddlewarein yourMIDDLEWARE_CLASSES, butX_FRAME_OPTIONSis not set to'DENY'. The default is'SAMEORIGIN', but unless there is a good reason for your site to serve other parts of itself in a frame, you should change it to'DENY'. -
security.W020:
ALLOWED_HOSTSmust not be empty in deployment.
Sites
The following checks are performed on any model using a CurrentSiteManager:
-
sites.E001:
CurrentSiteManagercould not find a field named<field name>. -
sites.E002:
CurrentSiteManagercannot use<field>as it is not aForeignKeyorManyToManyField.
Database
MySQL
If you’re using MySQL, the following checks will be performed:
-
mysql.E001: MySQL does not allow unique
CharFields to have amax_length> 255.
Templates
The following checks verify that your TEMPLATES setting is correctly configured:
-
templates.E001: You have
'APP_DIRS': Truein yourTEMPLATESbut also specify'loaders'inOPTIONS. Either removeAPP_DIRSor remove the'loaders'option.
Caches
The following checks verify that your CACHES setting is correctly configured:
-
caches.E001: You must define a
'default'cache in yourCACHESsetting.
URLs
The following checks are performed on your URL configuration:
-
urls.W001: Your URL pattern
<pattern>usesinclude()with aregexending with a$. Remove the dollar from theregexto avoid problems including URLs. -
urls.W002: Your URL pattern
<pattern>has aregexbeginning with a/. Remove this slash as it is unnecessary. -
urls.W003: Your URL pattern
<pattern>has anameincluding a:. Remove the colon, to avoid ambiguous namespace references.
© Django Software Foundation and individual contributors
Licensed under the BSD License.
https://docs.djangoproject.com/en/1.9/ref/checks/