#django

looking for comments regarding django-stripe-payments vs django-paypal vs braintree by paypal

or other

mekhami: in you nginx config you can make the django app listen on a certain path like /api, if you can do the same with express it should be feasible

only issue I see is that express will eat the /api url before nginx does

no idea how express works and what it is exactly

you could maybe proxy /api requests in express to nginx or maybe uwsgi/gunicorn directly

xBBTx: that's what i was afraid of

maybe i should just host the api on a subdomain

I'd go that route yeah

apollo13: ping

apollo13: ping

d0p: don't do that

got disconnected srry

what is a good way to display help pages for new visitors? Afterwards, they are routed to the regular view

d0p: mhm?

wrong question…

get your client in control, then this is your problem unless you wanna pay :D

ahhah

yes I do mind

please fix your client to send proper messages

fwiw, actually putting a realname into whois and trying to write normal sentences would certainly help too if you want professional help

do i have someone ignored or is apollo13 talking to himself

I have no idea, he is sending weird messages, they are apparently not queries, but…

ah seems likes notices

how annoying

hi, I have the following: o = {"key":"<script>"}; json.dumps(o); << how can I make sure I prevent XSS? is the only way to encode all the values or there is a better way of doing it ?

ocZio https://www.owasp.org/index.php/XSS_(Cross_Site... maybe? Basically, escape the output.

jaddison: I am not sure escaping the whole output will keep the JSON object intact.

Is it a true statement, that in general Django will not have an issue supporting multiple authentication methods, e.g. rest-framework-jwt, oauth-toolkit, etc ?

ocZio, why not escape the internal value, not the whole json object? the outside looks fairly benign to me.

Also, anyone heard an ETA for 1.9?

jaddison: that's my question, is this the way to go? or there is a better way :)

I am falling under this: https://www.owasp.org/index.php/XSS_(Cross_Site...

litewait 2 weeks after most recent rc.

litewait, yes, Django supports multiple authentication methods. That's how sites have email+password as well as social logins. Two different auth backends.

(or more)

ocZio: use the filter from django-argonauts

worried the auth middleware will step on each others toes, but ok. thanks.

It is possible for auth backends to 'clobber' one another though.

hehe