4 ms·

I've worked with Django and nodejs as well. When working with node, I usually just grab express and some decent ORM that knows how to postgres, and I feel like

I've worked with Django and nodejs as well. When working with node, I usually just grab express and some decent ORM that knows how to postgres, and I feel like I'm pretty much there. I've just never missed anything from Django. I haven't worked with rails yet though.

leephillips 5y ago
Does your solution have protection against cross-site scripting attacks?
- deleted 5y ago
  [deleted]
- dzonga 5y ago
  you can use same-site cookie attribute to prevent csrf attacks these days.
  - leephillips 5y ago
    Not an ideal defense, as explained at https://portswigger.net/web-security/csrf/samesite-cookies https://portswigger.net/web-security/csrf/samesite-cookies But there are many things the programmer can do to defend against csrf attacks. But you have to know about the problem and know how to defend against it. When I made my first Django site 20 years ago I hadn’t even heard of csrf, yet was protected against it by the framework. It has many such benefits included, so you can make a secure site while knowing little about web security. And an efficient one: it caches DB data for you, for example. On the downside, as others have mentioned, it’s built using Python class inheritance magic, so can be a headache to modify its behavior.
bluewalt 5y ago
You can not say you get feature parity just after plugging an ORM to express. Of course if you're building a todolist, I understand the point, but as soon as you have more need, the journey of searching for packages, comparing them, test them, read their doc, starts. Some things I have in mind: security, authentication, file uploads, role management, testing, cache, admin, etc.
- Jean-Philipe 5y ago
  > You can not say you get feature parity just after plugging an ORM to express. It's also not what I said :-) Admin is a good point though. I actually do miss that when working with node.

leephillips 5y ago

Does your solution have protection against cross-site scripting attacks?

deleted 5y ago
[deleted]
dzonga 5y ago
you can use same-site cookie attribute to prevent csrf attacks these days.
- leephillips 5y ago
  Not an ideal defense, as explained at https://portswigger.net/web-security/csrf/samesite-cookies https://portswigger.net/web-security/csrf/samesite-cookies But there are many things the programmer can do to defend against csrf attacks. But you have to know about the problem and know how to defend against it. When I made my first Django site 20 years ago I hadn’t even heard of csrf, yet was protected against it by the framework. It has many such benefits included, so you can make a secure site while knowing little about web security. And an efficient one: it caches DB data for you, for example. On the downside, as others have mentioned, it’s built using Python class inheritance magic, so can be a headache to modify its behavior.

bluewalt 5y ago

You can not say you get feature parity just after plugging an ORM to express. Of course if you're building a todolist, I understand the point, but as soon as you have more need, the journey of searching for packages, comparing them, test them, read their doc, starts. Some things I have in mind: security, authentication, file uploads, role management, testing, cache, admin, etc.

Jean-Philipe 5y ago
> You can not say you get feature parity just after plugging an ORM to express. It's also not what I said :-) Admin is a good point though. I actually do miss that when working with node.