4 ms·
> - A huge ecosystem of libraries for everything from data science to email processing, that are (mostly) easy to read and modify and free from systemic securit
by dcbadacd 8y ago
> - A huge ecosystem of libraries for everything from data science to email processing, that are (mostly) easy to read and modify and free from systemic security issues. And pretty much every major company with an API has an official Python library for that API.
I disagree about this, there's not even a basic user signup flow plugin with page templates that would allow SSO and U2F, it was so when I was looking at it three months ago. With Flask I can use Flask-Security, Flask-Dance and I have user signup, pw resets, SSO. With CSRF protection out-of-box and bunch of other security features are easy to turn on compared to Django. What I did like about Django was the idea and maybe I would've liked Django-Admin if I didn't have to reinvent three wheels out of four.
- deleted 8y ago[deleted]
- _visgean 8y agoU2F and django was easy last time I have done it. Which was about year ago.
- Alex3917 8y agoThere was a mailing list discussion about building U2F into Django, and I agree that should get done. I don't know a ton about SSO, although I'm more skeptical about building it into Django only because there are many different ways you might want the business logic to work, so to me that suggests using a library for that might be more appropriate than having it built into the framework.
- dcbadacd 8y agoThere's not even a good 3rd party library, I spent like a day testing all of them out and it's so cumbersome compared to what I had to do with Flask-Security and Flask-Dance.
- Alex3917 8y agoFair. I had the same issue a few weeks ago implementing OAuth as a provider. There is a library that is reasonably functional, but the documentation is so bad that if you followed it verbatim there would be huge security holes in your app.