1

I am new to Django and I am working on a website, where you can filter some articles using a normal GET url query string param. Theese params can be made from some input fields. I have found two different ways to approach this, but I am concerned about the security. Which one of theese methods is most secure thinking about vulnerabilities like xss and csrf or some scary characters in the URL?

The first option is to use javascript to collect and add the values from the input fields to a string, and then use the javascript function "window.location.href" to change the clients URL. I am not using any form here. At the server side at views.py:

class IndexView(generic.ListView):
template_name = 'index.html'
model = Articles

def get_context_data(self, **kwargs):
    if self.request.method == 'GET':
        context = super().get_context_data(**kwargs)
        queryObj={}
        category = self.request.GET.get('category')
        if category:
            queryObj["category"] = category
            #adds params to a dictionary if true

        sub_category = self.request.GET.get('sub_category')
        if sub_category:
            queryObj["sub_category"] = sub_category



        context['adrticleList']=Articles.objects.filter(**queryObj) 

        return context

The other solution I can think of is to make a Django form with a GET action. This way a can validate the request and protect the client with Django's built in template tags like {% csrf_token %}.

Since it is just GET requests and I am not excpecting users to submit sensitive data, is it really something to worry about?

And if I use forms, the class based view can be a litle bit complex since I am quite new, so can I use function based views, or does this increase the chance for security mistakes?

I am also planning to implement an ajax request to make some dependent dynamically select boxes.

Thanks for thoughts and advices.

0

If you don't need CSRF protection because the request is idempotent then you don't need a CSRF token.

Reading request.GET in the view, with or without a form, does not affect security.

Using function based views or class based views does not affect security.

I believe simplicity is good, so I would recommend to always use function based views because they are simpler to reason about.

Using a form to validate query params is a matter of convenience. If you need to write a validator, if it's more organized to write it as a custom FormField or as def clean of a form (logic concerning multiple fields at once) then you should use a form. If you validate the same kind of data in multiple places, it makes sense to use a form for the Do not Repeat Yourself principle.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.