Generator tags for HTML meta elements

Django Internals
1

There is tag meta in HTML that allows you to list the generator (typically framework) of a website, like so:

<meta name="generator" content="Framework version x.y.z">

This tag is useful for anyone or any tool interested in knowing the back-end or static site generator behind a website. It is also a tool used by tools that gather usage statistics of various technologies.

I was looking at Eleventy, and they provide the value for the generator tag by default, and allow the developer a choice of whether to inject it in their markup. They also have an explanatory blog post and video linked in their documentation. (See below)

Would this be an interesting value to provide to Django-powered templates by default?

People can add this this tag themselves, but standardizing the tag would allow for consistent implementation. It would also make it easier to add the current Django version number to the tag.

One could argue that the generator tag, and especially the specific Django version number, would make it easier for malicious parties to hack a website. It would also make it easier to find outdated versions of Django on the web. I assume that omitting the value is not going to stop hackers from trying, but it is worth thinking about.

The tag might also be useful if anyone ever wants to make an automated successor to djangosites.org. (See also: Replace “Django-powered Sites” link in Community sections)

Related links:

2 Likes
2

Hey @Mah-Rye-Kuh :wave: that’s an interesting one. I think it’s more tricky for Django than for Eleventy, because most Django sites out there have a server component which is way more likely to be vulnerable to attacks than a static site. And knowing which framework a site uses and which version is very useful for targeted attacks. It’s possible to get this information from a site already, but adding a generator meta tag with a version number makes it quite a bit easier.

Would this be an interesting value to provide to Django-powered templates by default?

For my type of work it can be really useful to know the version of Django when I have admin access to a site but no code access. So it’d clearly help to have an official template tag to retrieve and display the version number in a template in the admin.

The generator tag – I’m not convinced. The detection benefits are small if it’s opt-in, the security risk is small too, but probably big enough to outweigh the advantages for a framework like Django. If we wanted to encourage people to showcase what their sites are built with, I think I’d recommend looking into humans.txt files – though here as well there are security considerations.

2 Likes
3

For my type of work it can be really useful to know the version of Django when I have admin access to a site but no code access.

Funnily enough I had a friend who wrote a script that could guess the Django version based on the admin login screen code. That was back in 2016 though so but sure if it would still work but it was an interesting security-related exercise :laughing:

1 Like
4

That sounds like a separate feature, but I like it.