Re: Preventing illegal method calls

Thank you, Ben!

2014. szeptember 15., hétfő 6:45:42 UTC+2 időpontban Ben Scherrey a következőt írta:

This is the nature of the HTTP protocol and RESTful architectural style. Understand that a URI is just an address for a resource - it is not an action or command. The HTTP verbs are the actual commands. So which HTTP verb you send determines what action you want to occur on that resource. This means absolutely you must pay attention to what HTTP command gets sent every time as the semantics of each are completely different.

For #1 - a GET request is what a browser sends when you want to see the content of that URI. That's the correct behavior.

For #2 - remember that HTTP is a stateless protocol where all state, including which user has rights to access what data and also the control of the data's integrity, being managed by the server. So again, absolutely, your server code must evaluate what the request is and make sure it's a legitimate request given the state of the system.

-- Ben

On Sun, Sep 14, 2014 at 4:32 AM, Jagger <zun...@gmail.com> wrote:

Hi Everyone!

My question is how can I prevent illegal method calls in django web application.

For example, take a method that updates the data of ExampleModel:

def examplemodel_changeform(request, examplemodel_id):

#Here is the source code of model updating...

Clicking on the submit button, the form data will be posted from the browser with this URL:
http://127.0.0.1:8000/examplemodel_changeform/40/

The ExampleModel, where examplemodel_id=40 will be updated with the posted data. This is what I expect to happen.

But,

Problem No1: Typing the URL above into the address bar of the browser, it will send a GET request.

Problem No2: On the client side there are listed only the "active" ExampleModel items in the application. So the user will update only the active items. But with other tools it is possible to send a POST for non active items.

For example, sending a post to this URL (http://127.0.0.1:8000/examplemodel_changeform/50/), when ExampleModel, where examplemodel_id=50, isn't in active status.

Which is the correct django/python way to solve this problem? Do I need to check all things (GET/POST, status...) on every http request?

Thank you in advance!

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users...@googlegroups.com.
To post to this group, send email to django...@googlegroups.com.
Visit this group at http://groups.google.com/group/django-users.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/52ed7be5-836f-4325-88bc-b48c91738ae2%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
Chief Systems Architect Proteus Technologies

Chief Fan Biggest Fan Productions

Personal blog where I am not your demographic.

This email intended solely for those who have received it. If you have received this email by accident - well lucky you!!

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To post to this group, send email to django-users@googlegroups.com.
Visit this group at http://groups.google.com/group/django-users.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/1b60b3c3-136f-4169-9340-d2ac02776c42%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.