A
A
Alex Xmel2020-10-08 13:14:12
Django
Alex Xmel, 2020-10-08 13:14:12

How to properly handle a callback in django?

There is a site on which it is necessary to process the callback. Since I have never done this, I ask you to comment on the correctness of my thoughts.
1. Callback is a normal external request. That is, the nature of this request is not important to me - it can be initiated by both the client's browser and any third-party service
2. Is the callback just a GET request or maybe POST ?
3. for processing, I create a separate address in url.py on which a regular view hangs with an incoming request. Further, I parse this request into parts depending on the structure of the data given to me?
4. If question 3 is yes, then what to do if some attacker starts sending garbage to this address?
5. I need to return "ok" as an answer. Here I did not understand at all. Where exactly to return this ok? Just write return HttpResponse('ok') at the end of the view?

I think it makes no sense to create a new topic, I will continue here.
Here is what I wrote for handling the callback:

class CallBackPage(View):
def get(self, request):
with open(BASE_DIR / 'logs/callback.log', 'a', encoding='utf-8') as f:
f.write('callback log get' + '\n')
f.write(str(request.GET) + '\n')
return HttpResponse('ok')

def post(self, request):
with open(BASE_DIR / 'logs/callback.log', 'a', encoding='utf-8') as f:
f.write('callback log post' + '\n')
f.write(str(request.POST) + '\n')
return HttpResponse('ok')


those. I'm waiting for a request to the address registered in url.py. If I myself click there in the browser, then everything works fine. A GET request is processed and the request text is written to a text file.
When I wait for a request from a third-party service that should be sent by POST, nothing happens. What is wrong? Perhaps I do not understand some basic fundamental things?

Answer the question

In order to leave comments, you need to log in

1 answer(s)
S
Sergey Gornostaev, 2020-10-08
@Desead

  1. Yes.
  2. POST only.
  3. Yes.
  4. Do not process garbage and/or accept with the request a key unknown to the attacker.
  5. Yes.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question