Hello 👋

A pragmatic guide to Django architecture patterns, based on real-world experience building and scaling a large SaaS application over 6 years.

For the past two years, I have been self-hosting most of my personal projects and daily tools on a small but powerful ThinkCentre M710 Tiny. Here’s my two-year feedback. Why Did I Start Self-Hosting? I could spend hours justifying my decision by arguing that we rely too much on big corporations that take our data for free. But, simply put, I wanted more control over my digital life, the ability to run only the services I truly need, and to avoid spending my entire budget on server costs. ...

Flutter Has a Package Problem It’s true that abandoned projects in open source software (OSS) are common. NPM is infamous for the number of abandoned packages, which is mainly due to the lack of internal utility libraries, where for instance Python internal libraries shine. However, maintaining a Flutter package is more challenging since you need to account for at least two platforms for mobile (iOS/Android), and increasingly, web and desktop applications if you are brave enough. ...

It has been almost 4 years since I launched my SaaS business in Django, while fancier Python frameworks have been released since then, Django still remains king of the Python web framework. Thanks to an ever-growing ecosystem of packages and their outstanding stability. Only the most useful and stable packages have made the cut, links to the official package source are included in the title itself. ...

In 2021, I was one of the many beta testers of GitHub Copilot. Back then, AI programming tools weren’t widely used, Stack Overflow was still a go-to resource, and solving coding challenges relied mostly on pure brainpower. Fast forward to 2024, and programming has evolved into something entirely different. Let’s talk about it. ...

After working with Django for more than 4 years both professionally and personally, I have learned a lot of tips and tricks that I wish I knew when I started. In this article I will share some of the most important ones that I have learned over the years. Since Django documentation is very good, I will not share many code snippets, but rather explain the concepts and provide links to the official documentation. All of these tips and tricks came from my own experience, the Django documentation, and Two Scoops of Django book. ...

Web Security is a significant concern for me. Over the past few years, I’ve been learning about ethical hacking and the broader field of web and server security and one topic that has always intrigued me is session hijacking. While many security threats, such as weak passwords, SQL injections, and cross-site scripting (XSS), have been mitigated and are relatively easy to fix, session hijacking remains a persistent threat. Its ease of exploitation and potential damage make it a serious risk to web applications. ...

The Django admin interface is one of the standout features that make Django such a powerful framework. It allows you to manage your data, customers, and models with ease. However, as with any tool that provides significant control over your application’s data, there’s a need to ensure that sensitive actions like deletions are handled carefully. ...

Lists or arrays are commonly used data types in programming. However, Django does not have a built-in field for storing lists in models. In a recent project, I needed to store a list of strings in a model, and I had to find an elegant and efficient way to store the list in the database. ...

These are my personal notes from reading Fluent Python. They’re a bit scattered, but I’ve found them useful for understanding some of Python’s more advanced features, like decorators, generators, and defensive programming. I’m sharing them here in case they’re helpful to others working through similar topics or if you’re considering reading the book. ...

Mise à jour — juillet 2026. Cet article date de 2024 et reflète ce que je pensais après six mois de HTMX. Deux ans plus tard, j’ai changé d’avis et je suis revenu en arrière. J’ai raconté pourquoi, en détail, dans HTMX et Django, l’erreur de parcours. Je laisse ce texte en ligne tel quel : le raisonnement de l’époque reste valable dans son contexte, c’est la conclusion qui a bougé. ...

Introduction In this article, I will provide a comprehensive overview of the essential security practices and configurations that you should consider when developing a Django application. A good starting point to ensure that your application is secure and follows the latest security best practices and guidelines is to use the well-known cookiecutter-django template. This template provides a solid foundation for building secure Django applications by incorporating various security features and configurations out of the box. ...

As of 0.56.0 release of django-allauth (2023-09-07) the support for Multi-Factor Authentication (MFA) has been added. This is great news for the Django developer as it allows you to easily add MFA to your applications, but the documentation is still a bit sparse, and it appears that the feature is not widely known yet. ...

Two years ago, on the 15th of January 2022, I decided to launch my startup with my co-founder, a SaaS service built for hospitality professionals to help them with their day-to-day tasks that I was building for the past year. In those two years, I have travelled to 7 different countries, built a website and two mobile apps from scratch and a lot more. Let’s take a look back at what I have learned. ...

As good of a developer as you are, you are not immune to data loss, mistakes happen either by you or an outside force, so it is important to have a backup strategy in place and this needs to be done before you need it. One of the most popular backup strategies is the 3-2-1 backup strategy, but what does it mean and how can you implement it for almost no cost and effort? ...

A few days ago I started receiving concerning emails directly to my work email address, the email was from a so-called bug bounty hunter that was claiming to have found a vulnerability in one of our products, the email was very generic and it was not clear what was the vulnerability, the only thing that was clear was that the person was asking for money to disclose the vulnerability. ...

Django is by design very secure, most of the common vulnerabilities such as XSS, CSRF, SQL injection, clickjacking are fixed by the simple use of the framework, but there is one that is not fixed by default, and it is the Idor vulnerability. In this article we will see what it is and how to fix it. ...

When working with Django for my startup I performed on several occasions very complex migrations and maintenance tasks that required the site not to be accessible for a few minutes and sometimes even hours. Even if the end user is not able to access the site, our team of superusers and admins should be able to access the site and perform the maintenance tasks. ...

One of the most loved features of Django is the built-in administration interface. It allows for an easy way to manage your data and is highly customizable. However, it is also a very common target for attackers. In this article, we will look at some of the most common attacks against the Django administration interface and how to protect against them. ...

When working with Django and third party libraries, you may encounter a CSRF error on login or any other form submission. This is because Django requires a CSRF token to be sent with every form submission except GET requests or if the form has the csrf_exempt decorator. During my work with Django, I have encountered this error many times, sometimes due to my own mistakes and sometimes due to third party libraries or user behavior. ...

I am a long time user of DigitalOcean and I have been using many of their services for more than 6 years, including their Cloud Firewall. I have been using it for a long time and I have been very happy with it. Most of the time when people create a new droplet they just leave their server open to the world, which is not a good idea, especially if you are running a production server. ...