django-passkeys
django-passkeys copied to clipboard
Improve views query
- Update GitHub Actions' steps version.
- Update query and syntax in
passkey/views.py
.
https://github.com/mkalioby/django-passkeys/blob/abb687b491180c40e1021ecfdb8b734b23d03203/passkeys/views.py#L15-L19
I think there is a risk that Passkey ID on database will be leaked.
If you are checking user matches, I think it would be a good idea to retrieve it as a query and set it as Not Found.
https://github.com/mkalioby/django-passkeys/blob/abb687b491180c40e1021ecfdb8b734b23d03203/passkeys/views.py#L23
id
is reserved as a built-in function.
$ python
>>> id
<built-in function id>
https://github.com/mkalioby/django-passkeys/blob/abb687b491180c40e1021ecfdb8b734b23d03203/passkeys/views.py#L24-L27
if q.count()==1: # a query
key=q[0] # a query
# follow code...
This code generates the query twice.
Also, here we only have one matching data, so we can improve it by using first()
.
https://github.com/mkalioby/django-passkeys/blob/abb687b491180c40e1021ecfdb8b734b23d03203/passkeys/views.py#L30
django.http.response
provides HttpResponseForbidden
and the status is set to 403.