202 lines
9.4 KiB
Plaintext
202 lines
9.4 KiB
Plaintext
---
|
|
description: Comprehensive guide to Django best practices covering code organization, performance, security, testing, and common pitfalls. This rule ensures adherence to community standards for maintainable and efficient Django applications.
|
|
globs: *.py
|
|
---
|
|
# Django Best Practices and Coding Standards
|
|
|
|
This guide outlines best practices for developing Django applications to ensure code quality, maintainability, performance, and security.
|
|
|
|
## 1. Code Organization and Structure
|
|
|
|
- **Directory Structure:**
|
|
- **Project Root:** Manage.py, settings, urls, wsgi.
|
|
- **Apps:** Each app should reside in its own directory.
|
|
- **Static Files:** Separate directory for static files (CSS, JavaScript, images).
|
|
- **Templates:** Dedicated directory for HTML templates.
|
|
- **Media:** For user-uploaded files.
|
|
- **Tests:** Tests for each app in a separate tests/ directory.
|
|
|
|
- **File Naming Conventions:**
|
|
- Use lowercase letters with underscores (snake_case) for Python files and variables (e.g., `models.py`, `user_profile`).
|
|
- Classes should use CamelCase (e.g., `UserProfile`).
|
|
- Function names should use snake_case (e.g., `get_user_profile`).
|
|
|
|
- **Module Organization:**
|
|
- Each app should be a self-contained module.
|
|
- Group related functionalities into submodules within the app.
|
|
- Use `__init__.py` files to define packages.
|
|
|
|
- **Component Architecture:**
|
|
- Follow the Model-View-Template (MVT) architecture.
|
|
- Keep models lean and focused on data representation.
|
|
- Use views for request handling and business logic.
|
|
- Templates should focus on presentation.
|
|
|
|
- **Code Splitting Strategies:**
|
|
- Break down large views into smaller, reusable functions or class-based views.
|
|
- Use mixins to share functionality across multiple views.
|
|
- Implement custom template tags and filters for reusable template logic.
|
|
- Consider using Celery for asynchronous task processing.
|
|
|
|
## 2. Common Patterns and Anti-patterns
|
|
|
|
- **Design Patterns:**
|
|
- **Model-View-Template (MVT):** Django's core architectural pattern.
|
|
- **Form Objects:** Use Django's forms for handling user input and validation.
|
|
- **Signals:** Implement signals for decoupled event handling.
|
|
- **Managers:** Use custom model managers to encapsulate query logic.
|
|
- **DRY (Don't Repeat Yourself):** Avoid redundant code by extracting reusable components.
|
|
|
|
- **Recommended Approaches:**
|
|
- **Database Interactions:** Use Django's ORM for database interactions. Avoid raw SQL queries unless necessary.
|
|
- **Form Handling:** Leverage Django's form classes for data validation and rendering forms.
|
|
- **URL Routing:** Use named URL patterns for reverse URL lookup.
|
|
- **Template Inheritance:** Utilize template inheritance to create a consistent look and feel.
|
|
|
|
- **Anti-patterns and Code Smells:**
|
|
- **Fat Models:** Avoid putting too much business logic in models. Use services or utility functions instead.
|
|
- **Complex Templates:** Keep templates simple and focused on presentation. Move complex logic to views or custom template tags.
|
|
- **Hardcoded Values:** Avoid hardcoding values in code. Use settings or environment variables.
|
|
- **Ignoring Security:** Neglecting security best practices can lead to vulnerabilities.
|
|
|
|
- **State Management:**
|
|
- Use Django's session framework for managing user sessions.
|
|
- Avoid storing sensitive data in sessions.
|
|
- Consider using a dedicated caching system (e.g., Redis, Memcached) for storing frequently accessed data.
|
|
|
|
- **Error Handling:**
|
|
- Implement proper error handling using `try...except` blocks.
|
|
- Use Django's logging framework to log errors and warnings.
|
|
- Display user-friendly error messages.
|
|
|
|
## 3. Performance Considerations
|
|
|
|
- **Optimization Techniques:**
|
|
- **Database Optimization:** Use indexes on frequently queried fields.
|
|
- **Caching:** Implement caching at various levels (e.g., template caching, view caching, database caching).
|
|
- **Query Optimization:** Use `select_related` and `prefetch_related` to reduce the number of database queries.
|
|
- **Gzip Compression:** Enable Gzip compression for static files and responses.
|
|
|
|
- **Memory Management:**
|
|
- Avoid loading large datasets into memory. Use iterators or generators.
|
|
- Close database connections and file handles properly.
|
|
- Be mindful of memory leaks.
|
|
|
|
- **Rendering Optimization:**
|
|
- Minimize the use of complex template logic.
|
|
- Use template caching to cache rendered templates.
|
|
- Optimize images and other static assets.
|
|
|
|
- **Lazy Loading Strategies:**
|
|
- Implement lazy loading for images and other resources that are not immediately visible.
|
|
- Use pagination to display large datasets in smaller chunks.
|
|
|
|
## 4. Security Best Practices
|
|
|
|
- **Common Vulnerabilities:**
|
|
- **Cross-Site Scripting (XSS):** Prevent XSS by escaping user input in templates and using Django's `escape` filter.
|
|
- **Cross-Site Request Forgery (CSRF):** Protect against CSRF attacks by using Django's CSRF protection.
|
|
- **SQL Injection:** Use Django's ORM to prevent SQL injection attacks. Avoid raw SQL queries.
|
|
- **Authentication and Authorization Issues:** Implement proper authentication and authorization mechanisms.
|
|
|
|
- **Input Validation:**
|
|
- Validate all user input on both the client-side and server-side.
|
|
- Use Django's form validation to validate data.
|
|
- Sanitize user input to remove potentially harmful characters.
|
|
|
|
- **Authentication and Authorization:**
|
|
- Use Django's built-in authentication system for user authentication.
|
|
- Implement proper authorization checks to restrict access to sensitive resources.
|
|
- Use Django's permission system to manage user permissions.
|
|
|
|
- **Data Protection:**
|
|
- Store sensitive data securely using encryption.
|
|
- Use HTTPS to encrypt communication between the client and server.
|
|
- Protect against data breaches by implementing proper access controls and monitoring.
|
|
|
|
- **Secure API Communication:**
|
|
- Use authentication tokens or API keys to authenticate API requests.
|
|
- Implement rate limiting to prevent abuse.
|
|
- Validate all API input.
|
|
|
|
## 5. Testing Approaches
|
|
|
|
- **Unit Testing:**
|
|
- Write unit tests for individual functions and classes.
|
|
- Use Django's testing framework to write and run tests.
|
|
- Mock external dependencies to isolate units of code.
|
|
|
|
- **Integration Testing:**
|
|
- Write integration tests to test the interaction between different components.
|
|
- Test database interactions, form handling, and view rendering.
|
|
|
|
- **End-to-End Testing:**
|
|
- Write end-to-end tests to test the entire application flow.
|
|
- Use tools like Selenium or Cypress to automate browser testing.
|
|
|
|
- **Test Organization:**
|
|
- Organize tests into separate test suites for each app or component.
|
|
- Use meaningful test names to describe what each test does.
|
|
- Keep tests concise and focused.
|
|
|
|
- **Mocking and Stubbing:**
|
|
- Use mocking and stubbing to isolate units of code during testing.
|
|
- Avoid mocking external dependencies unless necessary.
|
|
|
|
## 6. Common Pitfalls and Gotchas
|
|
|
|
- **Frequent Mistakes:**
|
|
- **Incorrect Database Configuration:** Ensure that the database settings are configured correctly.
|
|
- **Improper Static File Handling:** Configure static file serving properly in production.
|
|
- **Not Using Django's Built-in Features:** Leverage Django's built-in features instead of reinventing the wheel.
|
|
- **Ignoring Security Warnings:** Address any security warnings or vulnerabilities reported by Django's security checks.
|
|
|
|
- **Edge Cases:**
|
|
- **Handling Time Zones:** Be mindful of time zones and use Django's time zone support.
|
|
- **Dealing with Unicode:** Handle Unicode characters correctly.
|
|
- **Managing File Uploads:** Implement proper file upload handling to prevent security vulnerabilities.
|
|
|
|
- **Version-Specific Issues:**
|
|
- Be aware of compatibility issues between different Django versions.
|
|
- Consult the Django release notes for information about breaking changes.
|
|
|
|
- **Compatibility Concerns:**
|
|
- Ensure that your code is compatible with different browsers and devices.
|
|
- Test your application on different platforms.
|
|
|
|
- **Debugging Strategies:**
|
|
- Use Django's debugging tools to identify and fix errors.
|
|
- Use logging to track the execution flow of your application.
|
|
- Consult the Django documentation and community forums for help.
|
|
|
|
## 7. Tooling and Environment
|
|
|
|
- **Recommended Development Tools:**
|
|
- **IDE:** PyCharm, VS Code, Sublime Text
|
|
- **Package Manager:** pip, uv
|
|
- **Database Client:** pgAdmin, MySQL Workbench
|
|
|
|
- **Build Configuration:**
|
|
- Use a `requirements.txt` file to manage dependencies.
|
|
- Use a virtual environment to isolate project dependencies.
|
|
|
|
- **Linting and Formatting:**
|
|
- Use Black to format code automatically.
|
|
- Use flake8 to lint code and identify potential errors.
|
|
|
|
- **Deployment Best Practices:**
|
|
- Use a production-ready web server (e.g., Gunicorn, uWSGI).
|
|
- Configure a reverse proxy (e.g., Nginx, Apache).
|
|
- Use a database server (e.g., PostgreSQL, MySQL).
|
|
|
|
- **CI/CD Integration:**
|
|
- Integrate your project with a CI/CD pipeline to automate testing and deployment.
|
|
- Use tools like Jenkins, Travis CI, or GitLab CI.
|
|
|
|
## Additional Notes
|
|
|
|
- Always follow PEP 8 guidelines for Python code.
|
|
- Write clear and concise comments.
|
|
- Keep your code DRY (Don't Repeat Yourself).
|
|
- Regularly update your dependencies.
|
|
- Monitor your application for performance and security issues. |