DEV Community: Sanket De

Django Framework

Sanket De — Thu, 15 Jun 2023 12:46:25 +0000

MVT Architecture

Django, a Python framework to create web applications, is based on Model-View-Template (MVT) architecture. MVT is a software design pattern for developing a web application. It consists of the following three entities:
1. Model
2. View
3. Template

Model

A Model is an object that defines the structure of the data in the Django application.
It is responsible for maintaining the entire application’s data for which it provides various mechanisms to add, update, read and delete the data in the database.

View

A View is a handler function that accepts HTTP requests, processes them, and returns the HTTP response.
It retrieves the necessary data to fulfill the request using Models and renders them on the user interface using Templates.
It can also create an HTML page using an HTML template dynamically, and populate it with data fetched from the model.

Template

A template is a text file that defines the structure or layout of the user interface. The text file can be any type of file; for example HTML, XML, etc.

Settings file

Secret Key A secret key used for cryptographic signing and securing sessions, forms, and other sensitive data. It should be kept secret and unique for each project.
Debug Mode A boolean flag indicating whether the project is in debug mode or not. In debug mode. It's recommended to set DEBUG = False in production for security reasons.
Allowed Host A list of strings representing the host/domain names that the project can serve. It is a security measure to prevent HTTP Host header attacks. In production, you should specify the actual domain names or IP addresses that your project will be served from.
Database Configuration DATABASES: A dictionary containing the configuration settings for the project's database connections.You can specify the database engine, name, user credentials, host, and other database-specific settings.
Application configuration
- INSTALLED_APPS: A list of Django applications installed in the project.
- Each application can define models, views, templates, and other components.
- Third-party applications are typically included by specifying their package names.
- Your project's custom applications should also be included here.
- In Django inside INSTALLED_APPS there are several default applicaition
  - django.contrib.admin: This app provides the Django admin interface, which allows you to manage and interact with your project's data models through a web-based interface.
  - django.contrib.auth: This app provides authentication and authorization functionality, including user authentication, permissions, and user management.
  - django.contrib.contenttypes: This app provides a framework for creating, storing, and retrieving content types. It is used by other apps to implement generic relationships between models.
  - django.contrib.sessions: This app manages user sessions and provides session-based data storage.
  - django.contrib.messages: This app enables cookie- and session-based messaging between users and provides support for displaying success messages, error messages, etc.
  - django.contrib.staticfiles: This app helps manage static files (CSS, JavaScript, images etc) and serves them during development.
Middleware
- Middleware in Django is a component that sits between the web server and the view, providing a way to process requests and responses globally before they reach the view or after they leave the view.
- It allows you to add functionality to the request/response processing pipeline.
Django Security
- Django is a well-known and widely used web framework that emphasizes security.
- It provides a range of built-in security features and follows best practices to help developers build secure web applications.
Cross-Site Scripting (XSS) Protection
- Django automatically escapes data rendered in templates, which helps prevent XSS attacks by default.
- Developers can also use the built-in template tags and filters, such as |safe, to mark specific content as safe from escaping.
Cross-Site Request Forgery (CSRF) Protection
- Django provides CSRF protection by generating and validating CSRF tokens for all POST forms.
- The CSRF token is included in form submissions and verified on the server side to ensure that the request is legitimate.
User Authentication and Authorization
- Django includes a robust authentication system that handles user registration, login, password hashing, and session management.
- It supports various authentication backends, including username/password, email/password, social authentication, and more.
- Django provides an authorization framework, including user roles, permissions, and groups, to control access to resources.
Password Hashing
- Django uses strong cryptographic algorithms, such as PBKDF2, bcrypt, or Argon2, for password hashing.
- It automatically handles password salting and stretching to protect against brute-force attacks.
Clickjacking Protection
- This type of attack occurs when a malicious site tricks a user into clicking on a concealed element of another site which they have loaded in a hidden frame or iframe.
- Django includes the XFrameOptionsMiddleware middleware, which sets the X-Frame-Options header to prevent clickjacking attacks.
WSGI
- WSGI stands for Web Server Gateway Interface. It is a specification that defines how web servers and web applications written in Python should communicate with each other.
- WSGI acts as a bridge between web servers (such as Apache or Nginx) and web applications (such as Django).
- In the Django, WSGI is used to connect the Django web framework with a web server.
- It allows the web server to forward requests to Django and receive responses back. This enables Django to run as a standalone web application, handling HTTP requests and generating HTTP responses.

Models file

In Django's models.py file, you define the structure and behavior of your application's data using classes that inherit from Django's Model class.
These classes represent database tables, and the attributes of the classes define the fields and relationships of the corresponding database table columns.
In Django, on_delete=Cascade is a parameter used when defining a foreign key relationship between two models. It specifies what should happen when the referenced object (the object being referred to by the foreign key) is deleted.
When on_delete=Cascade is specified, it means that if the referenced object is deleted, the objects that have a foreign key pointing to it will also be deleted (cascaded).
Fields and Validators: In Django's models, we have a variety of fields and validators available to define the characteristics and constraints of your model's attributes.
Some commonly used fields include CharField (for storing character strings), IntegerField (for storing integers), DateField (for storing dates), and ForeignKey (for establishing relationships with other models).
Validators, on the other hand, are functions or classes that validate the values of model fields based on certain criteria. Django provides built-in validators such as MaxValueValidator, MinValueValidator, EmailValidator, and RegexValidator.
You can also create custom validators to enforce specific validation rules on your model's fields.

Django ORM

Django ORM (Object-Relational Mapping) is a powerful feature of Django that allows you to interact with your database using Python code instead of writing raw SQL queries.
In the Django shell, you can execute ORM queries to interactively work with your Django models and perform database operations.
run the folloing command to get into django shell
```
python manage.py shell
```

References

https://www.educative.io/answers/what-is-mvt-structure-in-django
https://docs.djangoproject.com/en/4.2/topics/http/middleware/
https://medium.com/scalereal/everything-you-need-to-know-about-middleware-in-django-2a3bd3853cd6
https://frontegg.com/blog/django-authentication

Asynchronous JavaScript

Sanket De — Thu, 01 Jun 2023 09:45:49 +0000

Callbacks

In JavaScript, a callback is a function that is passed as an argument to another function and is executed later, typically after some asynchronous operation or when a certain condition is met.
Callbacks are commonly used in JavaScript to handle asynchronous tasks like making API calls, handling events, and executing code after a certain operation completes.


function greet(name, callback) {
  console.log('Hello, ' + name + '!');
  callback();
}

function sayGoodbye() {
  console.log('Goodbye!');
}

greet('Sanket', sayGoodbye);

In the above example, we have two functions: greet and sayGoodbye.
The greet function takes two arguments: name and callback.
It logs a greeting message with the provided name and then calls the callback function. In this case, sayGoodbye is passed as the callback function to greet.
When greet is invoked with the name 'Sanket', it logs "Hello, Sanket!" and then calls the sayGoodbye function, which logs "Goodbye!".

Promises

In JavaScript, promises are used to handle asynchronous operations in a more structured way compared to callbacks.
A promise represents the eventual completion (or failure) of an asynchronous operation and allows you to attach callbacks to handle the resolved value or the error.

function greet(name) {
  return new Promise(function(resolve, reject) {
    setTimeout(function() {
      if (name) {
        resolve('Hello, ' + name + '!');
      } else {
        reject('No name provided!');
      }
    }, 2000);
  });
}

greet('Sanket')
  .then(function(message) {
    console.log(message);
  })
  .catch(function(error) {
    console.log('Error: ' + error);
  });

In the above example, the greet function returns a new Promise.
Inside the promise, we created an asynchronous operation using setTimeout.
If a name is provided, the promise is resolved with the greeting message. Otherwise, it is rejected with an error message.

Code Control

In JavaScript, when an asynchronous operation, such as making an API call or waiting for a timer, is encountered, it is typically handled by the JavaScript runtime environment rather than directly controlled through code.
Here's a high-level overview of how the flow of data occurs in asynchronous operations:
- Synchronous Execution: JavaScript code is executed synchronously, line by line, in a single thread. Functions are pushed onto the call stack, and when a function call is encountered, it is executed and then removed from the stack.
- Asynchronous Operations: When an asynchronous operation, such as an API call, is encountered, it is offloaded to the browser's web API. The web API handles the operation asynchronously and continues executing the rest of the code.
- Callback/Event Handler: In asynchronous operations, callbacks or event handlers are typically registered to handle the completion or response of the operation. These callbacks are not executed immediately but are scheduled to be placed in the task queue once the operation is complete.
- Task Queue: The task queue (also known as the event queue) holds the callbacks or event handlers that are ready to be executed. Once the call stack is empty, JavaScript checks the task queue for any pending tasks.
- Event Loop: The event loop constantly checks if the call stack is empty. If the stack is empty, it takes the first task from the task queue and pushes it onto the call stack for execution.
- Execution of Callbacks: The callbacks or event handlers are executed one by one in the order they were added to the task queue. These callbacks can contain code that manipulates data, updates the user interface, or triggers further asynchronous operations.
- This flow allows JavaScript to handle asynchronous operations without blocking the main thread and ensures that callbacks are executed in the correct order.