Top 10 Django Best Practices You Should Follow

Correct Model Naming

Django models are object-relational mappers (ORM) that define the structure of an app’s database. They allow developers to interact with the database using Python codes rather than raw structured query language (SQL).

The models should be named appropriately to ensure they accurately represent the data they handle. Correct names for models increase the code’s readability, making it understandable for the development team. They also help in better debugging by creating logical relationships in the database.

Which Django best practices can you adopt to name the models correctly?

• Each model should be named in singular form since they are all individual entities. For example, use “Blog” in place of “Blogs.”
• Ensure that Django’s in-built models don’t clash with Python’s classes. For example, avoid naming a model “user,” which might conflict with “Django.contrib.auth.models.User.”
• Avoid abbreviations for clarity, like ‘category” in place of “Cat,” and use prefixes like “BlogComment.”

Here’s how you can use singular names in Django:

from django.db import models
        

class Customer(models.Model):  # Singular, descriptive name

first_name = models.CharField(max_length=50)

last_name = models.CharField(max_length=50)

email = models.EmailField(unique=True)

phone_number = models.CharField(max_length=15, blank=True, null=True)

def __str__(self):

return f"{self.first_name} {self.last_name}"  
    

Authentication and Authorization

User authentication and authorization are two key aspects of every web application. While authentication verifies a user’s identity, authorization defines the actions a user is allowed to perform. Both need to be implemented with robust security and effectiveness.

Web apps are large platforms that hold a huge database of sensitive information that users enter into forms, which needs to be protected. Django efficiently handles authentication, permissions, complex user roles, permissions, and groups to prevent unauthorized access.

Which Django best practices can you adopt to ensure effective authentication and authorization?

• Utilize the in-built authentication provided by Django for user management and session handling.
• Implement algorithms like PBKDF2 to hash passwords instead of storing them raw.
• Integrate multiple authentication systems (MFA) for sensitive apps.

Here’s how to use PBKDF2 in Django –

from django.contrib.auth.models import AbstractUser
         class CustomUser(AbstractUser):

pass  # Extend if needed

Cross-site Scripting (XSS) Protection

XSS is a common threat to web applications. In this type of attack, attackers inject malicious scripts into the pages of a website that other users view. There are two types of XSS attacks: Stored XSS and Reflected XSS.

Stored XSS, also known as persistent XSS, occurs when the malicious script is directly injected into the web app. Reflected XSS, on the other hand, means the malicious script is reflected off a web application onto the web browser.

If the website doesn’t have a proper system to sanitize the data, the maligned code can seep into the user’s browser. This eventually leads to the tracker stealing the user session cookies, accessing the user data, and compromising the user’s identity.

Which practices can you adopt to ensure robust XSS protection?

• Use the templating engine to convert special characters into HTML-safe equivalents.
• Utilize “mark-safe” judiciously while only using trusted content to neutralize potential scripts.
• Don’t insert user input directly into the templates and URLs, and use Django forms to clean and validate them before processing.

Here’s how you can prevent XSS in Django forms:

    from django import forms
         class UserInputForm(forms.Form):

user_input = forms.CharField(max_length=100)

        
    

Security and Testing

One of the major security attacks is cross-site request forgery (CSRF), which occurs when hackers steal user credentials and send unauthorized web requests. This attack tricks the user into performing an unwanted action on a site.

Django offers built-in protection models against CSRF to prevent damaged user relationships, changed passwords, and data thefts.

Best practices to adopt to test the web app security:

• Use token-based authentication, which helps you set an expiration timer to add another security layer and verify your identity once it expires.
• Implement a role-based access control (RBAC) to assign roles so that users can access only user features and only admins can access extended ones.

Here’s how you can use Django middleware to enforce CSRF in forms:

    
        
MIDDLEWARE = [

'django.middleware.security.SecurityMiddleware',

'django.middleware.csrf.CsrfViewMiddleware',

# Other middleware

]
        
    

Project Structure

Django’s best practices for optimizing the project structure follow a predefined layout that includes key elements like URLs, models, views, static files, templates, and settings. Building an organized project structure is important to make it more scalable and maintainable. It makes it easy to locate and modify files and also simplifies error handling.

Which best practices can you adopt to build a solid project structure?

• Break the project down into smaller app functions and split them into numerous files.
• Organize media and static files separately and use service modules to organize business logic and views.
• Use a templates directory to avoid naming conflicts and a version control system like Git.

Here’s how you can maintain a consistent naming version:

    from django.db import models
         
class BlogPost(models.Model):  # Use singular and descriptive names

title = models.CharField(max_length=200)

content = models.TextField()

published_date = models.DateTimeField(auto_now_add=True)

def __str__(self):

return self.title
        
    

Avoid Redundancy in Models

In Django models, redundancy is about storing duplicate or unnecessary information in the database. It could be derived from wrong calculations or existing data and can lead to increased database size, inconsistencies, and complications in managing data.

Avoiding redundancy reduces database size and simplifies the queries and logic for better performance.

Which best practices can you adopt to avoid redundancy in models?

• Compute values dynamically instead of storing them and use Django relationships.
• Break down the models and extract the fields into a separate table if multiple fields have the same information.

Here’s how you can avoid redundant storage:

    from datetime import date
         
class Person(models.Model):

name = models.CharField(max_length=100)

date_of_birth = models.DateField()


@property

def age(self):

return date.today().year – self.date_of_birth.year

        
    

Content Security Policy (CSP)

Having a CSP protects web applications from various types of attacks, such as XSS and SQL injection, by creating a security layer on trusted content types. It also allows you to specify which sources, like scripts or images, can be loaded on the site.

With a CSP, you can reduce the risk of malicious scripts being injected and prevent browsers from loading untrusted domains.

Which best practices can you adopt to implement a powerful CSP?

• Start with a Report-Only mode to monitor violations without blocking the content.
• Ensure any third-party scripts and styles are only from the trusted sources explicitly listed in your policy.

Here’s how you can configure the CSP directives:

    
         
CSP_DEFAULT_SRC = (“‘self'”,)  # Only allow content from the same origin


CSP_SCRIPT_SRC = (“‘self'”, “‘unsafe-inline'”,)  # Allow inline scripts


CSP_STYLE_SRC = (“‘self'”, “‘unsafe-inline'”,)  # Allow inline styles


CSP_IMG_SRC = (“‘self'”, “https://trusted-image-source.com”)  # Allow specific image sources
        
    

Database Fields

Database fields in Django store a particular data type. The fields have pre-built validation tools that only allow a specific type of data and will not support any other data type.

For example, an Integer field won’t support “ABC.” Django’s ORM system is compatible with various databases, such as PostgreSQL, MySQL, and SQLite. This makes it essential to map the database’s layout.

Which best practices can you adopt to use Django database fields effectively?

• Choose the right field type based on short or long texts or monetary or whole numbers.
• If the field has a fixed set of possible values, use choices for better readability.
• Avoid unnecessary lengths of characters and use the correct length to save space and run migrations after changes.

Here’s how you can use appropriate relationships:

    
         
class Order(models.Model):


customer = models.ForeignKey(Customer, on_delete=models.CASCADE)
        
    

Do Not Use Foreign-key with Unique=true

In Django, using ‘unique=true’ with ‘ForeignKey’ instead of ‘OneToOneField’ can sometimes give a medium warning. Avoiding using ForeignKey with unique=true creates more readability because OneToOneField explicitly communicates the type of relationship.

It also eliminates any potential misconfigurations, inheriting the Django-specific behavior, which reduces the risks of bugs in development and schema updates.

Which best practices can you adopt to avoid this usage?

• Use the Foreign-key field to create a ManyToOneRelationship field between two models.
• Use OneToOneField to establish one-to-one relationships when establishing a singular relationship between models.

Here’s the correct code for how you can do it:

    
         
class Order(models.Model):

class Profile(models.Model):


user = models.OneToOneField(User, on_delete=models.CASCADE)


bio = models.TextField(blank=True)
        
    

 HTTPS Usage

Hypertext transfer protocol secure (HTTPS) safeguards user data by encrypting the client-server connection. Being an extension of the HTTP protocol, HTTPS adds an extra security layer with transport layer security (TLS) or secure socket layer (SSL). The extra layer makes it difficult for malicious actions to breach the connection.

Which best practices can you adopt to use HTTPS effectively in Django?

• Use Django security middleware, which provides many settings like secure_ssl_redirect, secure_hsts_seconds, secure_hsts_preload, etc.
• Obtain an SSL/TLS certificate from the certificate authority (CA). CAs offer free 90-day certificates.
• Use built-in features for secure cookies.

Here’s an example configuration of a web server using Nginx after obtaining the certificate:

    
         
}


server {


# SSL Configuration


listen 443 ssl;


server_name example.com www.example.com;


ssl_certificate /etc/ssl/certs/fullchain.pem;  # Path to your SSL certificate


ssl_certificate_key /etc/ssl/private/privkey.pem;  # Path to your private key


ssl_protocols TLSv1.2 TLSv1.3;


ssl_prefer_server_ciphers on;


ssl_ciphers HIGH:!aNULL:!MD5;