Using django-rest-interface

Question

I have a django application that I'd like to add some rest interfaces to. I've seen http://code.google.com/p/django-rest-interface/ but it seems to be pretty simplistic. For instance it doesn't seem to have a way of enforcing security. How would I go about limiting what people can view and manipulate through the rest interface? Normally I'd put this kind of logic in my views. Is this the right place or should I be moving some more logic down into the model? Alternatively is there a better library out there or do I need to roll my own?

Answer 1

Well, from the look of things, there's an authentication parameter to Collection. (see this example: authentication.py)

Second, (even if Django doesn't have it yet,) there should probably be a middleware that does CSRF/XSRF form checking. (Oh, there seems to be one.) You should also be able to use the login_required and permission_required decorators in the urls.py.

Answer 2

Even with the Authentication parameter, you don't have fine-grained control over what people can do. The current implementation of the Django-REST interface doesn't track the user information, so you don't have this information available for doing fine-grained authorization checks.

See Issue #32.

However, it's relatively easy to extend it to add some features. I use a lot of subclasses to add features.

Updating the request with login information, however, is tricky in Django. Rather than do that, I leave the information in the Collection.

Right now, I'd estimate that between patches and subclasses, what I've written is about as big as rolling my own RESTful view functions.

Django-REST, however, gracefully and neatly handles HTTP Digest Authentication. I don't look forward to replacing theirs with some kind of decorator for my Django view functions.

[Maybe we should open a source forge project and work out a clean replacement?]

Answer 3

I would look into using django-piston http://bitbucket.org/jespern/django-piston/wiki/Home application if security is your main concern.

I have used django-rest-interface in the past, its reliable and though simple can be quite powerful, however django-piston seems more flexible going forward.