Belovol pro commented 5 years ago

I really appreciate your help, Ania. It's always very quick and helpful. Thanks a lot.

Wujek Dima.

Anna Morawska staff commented 5 years ago

Thank, it's nice to hear! Happy coding :)

Belovol pro commented 5 years ago

By the way.

here voila.dbelovol.ru  is my first site ever written. From scratch. It's still mock, but full featured. With intensive use of MDB. May be it would be interesting.  

Anna Morawska staff commented 5 years ago

Thank you for sharing, kudos from our team! 

BTW, my colleague has noticed that your API endpoint isn't secure, so please give it a second look :) 

Belovol pro commented 5 years ago

I’m totally anaware about security problems. 

From my level of understanding I see, that

1. My backend Django now works in debug mode. Intentionally. When in production it would be DEBUG=False  

2. I don’t use https. For a while. 

3. I don’t need any requests except GET to most of my api, so i’ll forbid them programmatically. 

So I see only one hole - user message receiving api. 

Would I use intrinsic Django (more precisely - djangorestframework) form and template system, there will not be any problems, because it implements CSRF protection. 

But I use mdb react forms, so I don’t have any solution for a while. 

If you or your colleagues see any other vulnerabilities, or can suggest any solution for above mentioned problems - it would be very helpful for me. 

I intend to pass CSRF token and send it back like hidden field. Like Django does. 

Bartłomiej Malanowski staff commented 5 years ago

Hello there!

In fact, we're not providing consulting services, but if you want to talk about Django, you can catch me at b.malanowski@mdbootstrap.com ;)