Book Image

Django Design Patterns and Best Practices - Second Edition

By : Arun Ravindran
Book Image

Django Design Patterns and Best Practices - Second Edition

By: Arun Ravindran

Overview of this book

Building secure and maintainable web applications requires comprehensive knowledge. The second edition of this book not only sheds light on Django, but also encapsulates years of experience in the form of design patterns and best practices. Rather than sticking to GoF design patterns, the book looks at higher-level patterns. Using the latest version of Django and Python, you’ll learn about Channels and asyncio while building a solid conceptual background. The book compares design choices to help you make everyday decisions faster in a rapidly changing environment. You’ll first learn about various architectural patterns, many of which are used to build Django. You’ll start with building a fun superhero project by gathering the requirements, creating mockups, and setting up the project. Through project-guided examples, you’ll explore the Model, View, templates, workflows, and code reusability techniques. In addition to this, you’ll learn practical Python coding techniques in Django that’ll enable you to tackle problems related to complex topics such as legacy coding, data modeling, and code reusability. You’ll discover API design principles and best practices, and understand the need for asynchronous workflows. During this journey, you’ll study popular Python code testing techniques in Django, various web security threats and their countermeasures, and the monitoring and performance of your application.
Table of Contents (21 chapters)
Title Page
Copyright and Credits
PacktPub.com
Contributors
Preface
Index

Cross-site request forgery


Cross-site request forgery (CSRF) is an attack that tricks a user into making unwanted actions on a website, where they are already authenticated, while they are visiting another site. Say, in a forum, an attacker can place an IMG or IFRAME tag within the page that makes a carefully crafted request to the authenticated site.

For instance, the following fake 0x0 image can be embedded in a comment:

<img src="http://superbook.com/post?message=I+am+a+Dufus" width="0" height="0" border="0">

If you have already signed into SuperBook from another tab, and if the site doesn't have CSRF countermeasures, then a very embarrassing message will be posted. In other words, CSRF allows the attacker to perform actions by assuming your identity.

How Django helps

The basic protection against CSRF is to use an HTTP POST (or PUT and DELETE, if supported) for any action that has side effects. Any GET (or HEAD) request must be used for information retrieval, for example, read-only.

Django...