#django

hello all! i'm trying to test a django view that has a login_required decorator set. how do I go about that? create a dummy user in the test suite and use that for authentication? or can I mock the authentication decorator away somehow?

asking for django 2.1

anyone know of a module that would let me setup an event people could RSVP for and provide a list of those that RSVPd?

code one?

uhg...what kind of answer is that

schinckel: I've been playing with the extended ModelQuerySet we were talking about the other day. It's...limited. Here's the one you shared: https://dpaste.de/cQEa#L9

schinckel: The big limitation I'm hitting is that I can't use it to do Q queries or queries through joined models.

v0lksman: A good one?

schinckel: Like, say I have a Book object with Authors. Using your code, I can do Author.objects.with_name('Joe Smith'). I can't do Book.objects.filter(authors__with_name='Joe Smith')

v0lksman: https://djangopackages.org/grids/g/calendar/ maybe that helps?

schinckel: And I especially can't do: Book.objects.filter(Q(authors__with_name="Joe Smith") | Q(authors__with_name="Joseph Smith"))

really? not slightly obvious I could code one given this is a coding community and it's kinda what we are all doing

I checked djangopackages...looking for some first hand experience, you know, from the community at large

or have I misunderstood what this channel is for?

v0lksman: your question is quite specific. just don't count on the first answer to be all you'll get

v0lksman: Also, there are so many levels your problem can be tackled with. in simplest form it's just few models and views...

or you may want to have complex system which allows calendar-like operation with free time search and such...

so question. if a django app uses a sql db (from whatever), is it ok to have some outside process work on the same radius?

erm, s/radius/db/

the idea here is to reimplement daloradius as a django app

hanetzer: Why it wouldn't be?

hanetzer yes, just be prepared for race conditions and the like

jtiai: I don't know, which is why I'm asking :P

never afraid to admit ignorance :)

hanetzer: what is "daloradious"?

jtiai: daloradius. php/etc front-end for the freeradius db backend

jtiai: freeradius is an enterprise network authentication solution/server

oh.

basically, instead of a wifi ap having one wpa2 psk, it auths against freeradius's list of users/passwords

finster: create a dummy user and then use client.login or client.force_login

hanetzer: it is fine as long as both are apps are written correctly

hanetzer: i think freeradius needs a specific sql schema? you will need to write your django models accordingly then, and likely use managed=False

moldy: yeah, specific schema

django works fine with many (but not all) external schemas

the main pitfall are composite primary keys, afaik. most schemas that have a single-column primary key should work easily

is there a description of the curl requests to make when going through the reset password flow? I want to use django's auth system from a phone app

v0lksman: Still in search for RSVP app?

I'm carefully reading https://stackoverflow.com/questions/47488400/dr... but don't know what to do next, does the phone app need to handl the csrf token?

morenoh149: That kind of depends. csrf is meant to make sure that for example login form you're filling originates from trusted page and not for example some phising site.

morenoh149: yes, but it might be better to use another authentication scheme to begin with

moldy: alright, thanks!

jtiai: yep I kind of understood that the cross-site bit means it's designed to work in the browser, not really a concern when writing a phone app

morenoh149: So as moldy said, you might consider some other authentication scheme.

moldy: would you use token authentication? I just read a lot of materials saying tokens are poor solutions for tracking sessions

Personally I'm fan of JWT...

this http://cryto.net/~joepie91/blog/2016/06/13/stop...

I'd love to leverage django's auth since it's rock solid and handles reset passwords

I _could_ store the token in a cookie but I don't see any tutorial on how to do this either (either generic with curls nor in react native which is what I'm using)

morenoh149: yes, i usually use token auth for this

morenoh149: are you using django-rest-framework?

yes, trying to anyway, kinda wavering back and forth between drf and vanilla django

morenoh149: http://www.django-rest-framework.org/api-guide/...

but I need to build a phone app, and later the website will probably be a react app I put on a cdn

and for password reset, maybe https://github.com/anx-ckreuzberger/django-rest...

morenoh149: I actually use stateless, short living JWT not ones that for example holds session information.

I've only ever used jwt as an auth token, stored in localstorage (for a website). The stuff I've read today suggest that is poor security, and brittle if you try to update or sign ppl out

perhaps a phone app doesn't have to worry about xss? so it's okay for it to store the token on the phone's disk?

jtiai: yes

v0lksman: https://github.com/toastdriven/django-rsvp that looked interesting, it's for old django but could be fun project to resurrect for never one.

jtiai: do you use a token that only stores the session id?

morenoh149: Nope. I trust django to handle that part correctly for me :)

morenoh149: DRF offers the auth scheme you need out of the box, you realize that, right?

jtiai: yeah saw that and django-event-rsvp both over 5 years old at this point. also found one that is used specifically for a wedding app. reviewing them in plan to write my own that will use mailchimp to maintain the lists and drip campaigns that could come from it

morenoh149: no need to get clever here, IMO.

"Token authentication is appropriate for client-server setups, such as native desktop and mobile clients."

thought I had seen a bunch of apps for DjangoCon in the past. can't find any info about them at all now though

googling "django event" anything returns stuff about celery and redis etc...not a great term to try to find hence my earlier question

moldy: I thought so, but when I chatted about it in this channel in the evening I got suggested to stick to sessions and cookies.

different crowd in this channel at different times of day

morenoh149: huh, that is surprising

morenoh149: maybe those people did not realize you are talking about a native desktop client

folks telling me "every mobile stdlib has support for cookies" so I started studying cookies and sessions and django built in auth

and reading about the disadvantages of jwt's for session management

if you are already using DRF, use the token auth it gives you

and when I make the SPA version of this project store the token as an httpOnly token right?

token in an httpOnly cookie rather

does DRF do that ootb?

i am not very familiar with SPAs, the ones i am involved with use oauth, but don't do that if you don't need it

i think you will want token auth there as well, but i am not sure

not sure if you'll want to store the token in a cookie, i think localstorage is more common?

SPA is "simple". since it's just web stuff. and a lot of javascript...

but, i know very little about frontend development

auth0 looks good but I'm building a consumer app so don't want to go there, for a smaller number of potential users I'd definitely use it

localstorage may be more common but I think it's wrong, if an attacker gets to execute js they can read the token, if the token has sensitive info they can get that. So you could also limit what you place in the token, like just the session id.

limit what you place in the token?

the token is just the token

this is why HttpOnly cookies are a thing https://developer.mozilla.org/en-US/docs/Web/HT...

it's just a random string

not jwt's, jwts can hold arbitraty json

morenoh149: well i am talking about the token auth that is built into DRF

one of the 'advantages' of jwts is you can put info in them to avoid db lookups

kk I hear ya

which, afaik, is designed for your usecase. so i am not sure why you don't just use it

I'll start using it now. I was advised to use cookies and sessions in my phone app a few days ago because things like https://developer.apple.com/documentation/found... exist and are well understood

i am sure that can work as well, but consider that you are *already* using a framework which ships token auth and recommends that in its documentation

I saw the recommendation as well. The folks here called that into question.

FunkyBob did :)

but reading the backlog, i am not sure he realized that 1) you are already using DRF and 2) DRF gives you that basically for free

I can't search the backlog :(

Do you know any good django app for messaging that supports anonymous messaging too?