updates for Secure Coding with Django

README.md

Secure Coding with Django

Created by Rudolf Olah

Setup Django

Get started with Django:

# Install redis for background task queues
# On Linux:
sudo apt-get install redis-server
# On Mac OS X:
brew install redis

# Set up the environment and install packages
virtualenv --python=python3 env
source env/bin/activate
pip install -r requirements.txt

# Django app
cd demo
# Run model and data migrations
python manage.py migrate

# Create admin user
# python manage.py createsuperuser --username admin

# Run redis server in another terminal:
redis-server

# Run the background worker in another terminal:
celery -A demo worker -l info

# Run tests
python manage.py test

# Run the server
python manage.py runserver

Users and Data and Logging In

There is some data loaded into the database after you run python manage.py migrate and a few users are created.

Use the username as the password to login:

• admin
• user_a
• user_b
• user_c

You can login with these users through the frontend application http://localhost:4200 and through the Django admin http://localhost:8000/admin/

Running the app with Docker

# Build the Docker image
docker build -t secure-django-app .
# Run the Docker image
docker run -p 8000:8000 -it --rm secure-django-app

Dockerfile

FROM python:3.8

# install redis
RUN apt-get update && apt-get install -y redis-server

# copy the dependencies file to the working directory
COPY requirements.txt /app/requirements.txt
COPY demo /app/demo
COPY post_data.txt /app/post_data.txt
COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf

# set working directory
WORKDIR /app

# install dependencies
RUN pip install -r requirements.txt

# set working directory for the Django app
WORKDIR /app/demo

# run the database migrations
RUN python manage.py migrate

EXPOSE 8000

# use the following command to run Redis server, background worker, and the Django server together using a process manager like supervisord
RUN apt-get install -y supervisor

CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]

settings.py

# ...

# same as in the course files, however the INSTALLED_APPS will need django-guardian
INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'oauth2_provider',
    'rest_framework',
    'django_filters',
    'guardian', # <-- this is necessary later on
    'api',
    'ugc',
    'billing',
    'twofactorauth',
]

# ...

supervisord.conf

[supervisord]
nodaemon=true
logfile_backups=0
logfile_format=%(asctime)s,%(levelname)s,%(name)s: %(message)s

[program:redis]
command=redis-server
stdout_logfile=/dev/stdout
stderr_logfile=/dev/stderr

[program:celery]
command=celery -A demo worker -l info
stdout_logfile=/dev/stdout
stderr_logfile=/dev/stderr

; [program:django]
; command=python manage.py runserver
; stdout_logfile=/dev/stdout
; stderr_logfile=/dev/stderr