how to prevent/ secure delete request method from any attacker in django

user_12992304 0
Viewed 66
@method_decorator(login_required, name='dispatch')
class CategoryDeleteView(DeleteView):
model = Category
template_name = 'board/delete.html'
success_url = reverse_lazy('category-list')

path('category/<int:pk>/delete', CategoryDeleteView.as_view(),name='category-delete')

if a attacker runs the script from logged in user browser with random category id, how we will prevent from this kind of attacks in Django or Django rest framework

django-rest-framework django python
1 Answers

One thing you could do in DRF, is specify a queryset of the allowed objects for the user. That way when trying to retrieve/delete an object that doesn't belong to him, he'll get a 404 not found response. For example:

class CategoryDeleteView(viewsets.ModelViewSet):

    def get_queryset(self):
        return Category.objects.filter(user=self.request.user)

Same thing goes for normal Django views (specify a pre-filtered queryset, and only let the user query that).

user_44921240
Related