SlideShare a Scribd company logo
XHR




django Forms in an API World
          http://www.northwesternflipside.com/2011/01/10/2011-where-are-the-flying-cars/
Lets talk about me



            Tareque Hossain
             Lead Software Engineer
Lets talk about forms


django Forms

And how we can use them in
this day & age of APIs!
What can you expect…
• What’s wrong with forms as it is
• How we use forms
• Issues using form in an API
  world
• Approaches for tackling the
  issues
• The solution
The good old days..


• Write up some HTML
• Throw some fancy template tags in
  there
       {{ my_awesome_form.as_p }}
• WIN
Fast forward a few years..



    You really dig APIs
Your setup looks like this:

                    Me likey!




                                I give you
No $#!7.                            API
Nuevo mundo..
• Django forms live on API server
  – Validates/ saves API requests
  – Doesn’t get rendered via template
• You’ve been writing forms in the
  frontend
  – Hardcoded HTML
  – Trying to match up data that API expects
API Clients
• Your website no longer lives on the same
  application space as the API
• Common API clients
  – A JavaScript MVC powered website
  – An android app
  – An iOS app
Forms on API Clients
The Issue
• You can serve most platforms with an
  HTML app
  – Write form in HTML on your webapp
• If you write native application for mobile
  – You recreate forms using the interfaces
    available
The Issue

• These interfaces you write
  – Don’t have any idea about the django
    forms residing on the API server
  – Only know what data to collect when you
    explicitly code them on each device
• There’s a disconnect
Houston we have a problem..
                  http://epicdemotivational.com/tag/beer/page/2/
Lets take a step back



  What is a form?
Lets take a step back

ˈ rm (noun)
fȯ
 a printed or typed document with
 blank spaces for insertion of
 required or requested information


                   Entry #4 at http://www.merriam-webster.com/dictionary/form
In the world of HTML


Part of an HTML document with input
interfaces for inserting required or
requested information
In the world of web apps

• A form is the interface we provide the
  application user to collect information
• It’s essential to any application where we
  collect data
In the world of django
django Forms

• A construct that:
  – Binds data (request.POST)
  – Validates data (clean)
  – Processes data (save)
  – Renders interface (as_p)
django Forms
• ModelForm
  – Turns your model into a form
  – Easiest way to get an interface for your
    data
• Widgets
  – Define specific properties for interface
    element
  – Separates presentation from data types
Why not just render via template?

You can’t if:
  – You only use django to power your API and
    the consumers are arbitrary
  – You run several django API servers each
    dealing with different data space
Think about this architecture
                   Profile API




                                   Analytics API
Content API




                                 Admin App
        User App
Your services are distributed

• Web applications we design are
  increasingly becoming:
  – Separated between presentation and data
    layer via API
  – Dependent on multiple API endpoints
  – Rich and complex in interface
Your services are distributed

• Your site content is retrieved using the
  Content API
  – You collect user feedback on content using
    forms
  – You provide admin interface to manage
    content using forms
Your services are distributed

• Information for users are stored and
  retrieved using Profile API
  – You allow log in, creation and update of
    profiles using forms
  – You provide admin interface to manage
    profiles using forms
Your services are distributed


• Site performance and user traffic is
  recorded to Analytics API
  – You provide admin interface to access and
    create custom reports using forms
Think again.
                            Profile API




                                            Analytics API
Content API




                                          Admin App
        User App
The Issue (contd.)

• At WiserTogether we love APIs & have
  a similar distributed setup
• We’ve been hardcoding forms in the
  frontend, collecting data and sending to
  API
The Issue (contd.)

• Whenever a data point in the backend
  changed, we had to update the form
• We have multiple clients who require
  different set of fields present on
  registration forms
  – Again, hardcoding in frontend
It was a mess
                $#^*!
What to do..

• django forms is used to validate and
  process our API data
• We wanted django forms to
  determine our frontend interface
  – But it was completely agnostic about
    backend forms!
What to do..

• Deliver form definition over API
• Render interface in the frontend from
  the retrieved definition
  – No more hardcoding
  – Forms in the user facing application
    changes as soon as backend form
    changes
What to do..

• Adjust form in whatever way
  necessary
  – Add/ remove fields from registration
    form
  – Frontend renders form exactly the way
    you want
  – No code change necessary in frontend
What to do..

• Contain form definition in one spot
• Allow a single central point to control
  interface on all applications
• Allow different API consumers to
  retrieve form definition
  – And render interface appropriate for the
    platform or device
3 step solution
Step 1


Serialize form with all information
necessary for reproduction at frontend
Step 2

• Devise methods to handle the
  following over API:
  – Deliver form definition
  – Receive form data
  – Validate form and deliver errors
  – If valid save the form
Step 3
• Handle forms in the frontend using
  API data
  – Render form
  – Submit data
  – If not valid, then display errors
  – If valid, then display success
    message, reload page or redirect as
    necessary
Step 1


Serialize form with all information
necessary for reproduction at frontend
django Remote Forms

• Extracts all information from a given
  django form or model form instance
• Goes through each field & widget to
  extract all necessary information
• Presents the information as
  dictionary for further manipulation &
  easy serialization into JSON
As easy as π
A JSON form
Step 2

• Devise methods to handle the
  following over API:
  – Deliver form definition
  – Receive form data
  – Validate form and deliver errors
  – If valid save the form
Points to Ponder
• Handle CSRF yourself of using X-
  CSRFToken
  – django CSRF middleware is not JSON
    friendly
• Encapsulate form processing in save
  method, similar to Model Form
Step 3
• Handle forms in the frontend using
  API data
  – Render form
  – Submit data
  – If not valid, then display errors
  – If valid, then display success
    message, reload page or redirect as
    necessary
HTML/JS/CSS Implementation
• We created a set of rendering and
  data handling tools for the frontend
  using:



• In future, we’ll be working towards
  iOS implementations as well
Backbone Form Handler
• Renders forms based on definition
  received over API
• Uses Handlebars template for
  rendering:
  – Core form structure (form tag, fields
    container, global errors)
  – Field & widget structure (help text, errors)
• Error rendering
Backbone Form Handler
• Allows instant validation
  – Similar to autocomplete
  – Field can be validated as soon as you
    move to next one
• Allows preloading of data
• Disallow editing of fields
  – Including selects, radio and checkboxes
• Provide submit buttons (if not supplied)
Handlebars Templates
                   Handlebars
                    Widgets
Sample Backbone View
                                  Instantiate
                                 form model



                                 Instantiate
                                  form view




            Initiate rendering
             by fetching the
             form definition
django Remote Admin
• A reviewer expressed interest
  – Use remote forms to expose django admin
    interface over API
• So I implemented a set of API endpoints
  – Exposes django admin app/model/instance
    data
  – Exposes admin forms
• And wrote a backbone app implementing
  django admin
Goals of django Remote Admin

• Allow administration of django
  projects over API
• No more ties to the same old
  interface!
• Use awesome Handlebars snippets of
  your own to spice up the interface
How does it work?
• Cycle through admin site registry
  – Extract app/model info and expose over
    API
• Create ModelForm from the model
  – Expose over API using django remote
    forms
• The backbone app calls the API
  – Allows browsing apps/ models
  – Allows creating/editing model instances
Further Work
• django Remote Forms
  – Implement file/ image uploading over
    API
• django Remote Admin
  – Load form/widget customizations from
    Admin classes
  – Implement pagination for foreign key
    loader
Demo
• Ask me about WiserTogether
  – github.com/WiserTogether/django-remote-forms
  – github.com/tarequeh/django-remote-admin
• Follow my tweets @tarequeh
• Shout out to Carlo Costino
• ind this presentation
  – slideshare.net/tarequeh
Q/A
• Ask me about WiserTogether
  – github.com/WiserTogether/django-remote-forms
  – github.com/tarequeh/django-remote-admin
• Follow my tweets @tarequeh
• Shout out to Carlo Costino
• ind this presentation
  – slideshare.net/tarequeh

More Related Content

What's hot

Functions in Python
Functions in PythonFunctions in Python
Functions in Python
Kamal Acharya
 
Literals,variables,datatype in C#
Literals,variables,datatype in C#Literals,variables,datatype in C#
Literals,variables,datatype in C#
Prasanna Kumar SM
 
Robot framework and selenium2 library
Robot framework and selenium2 libraryRobot framework and selenium2 library
Robot framework and selenium2 library
krishantha_samaraweera
 
Selenium IDE LOCATORS
Selenium IDE LOCATORSSelenium IDE LOCATORS
Selenium IDE LOCATORS
Mindfire Solutions
 
Belajar Postman test runner
Belajar Postman test runnerBelajar Postman test runner
Belajar Postman test runner
Fachrul Choliluddin
 
Open mic activity logging
Open mic activity loggingOpen mic activity logging
Open mic activity logging
Ranjit Rai
 
Using Postman to Automate API On-Boarding
Using Postman to Automate API On-BoardingUsing Postman to Automate API On-Boarding
Using Postman to Automate API On-Boarding
Postman
 
PHP Security
PHP SecurityPHP Security
PHP Security
Mindfire Solutions
 
Asp.net state management
Asp.net state managementAsp.net state management
Asp.net state management
priya Nithya
 
Python: Basic Inheritance
Python: Basic InheritancePython: Basic Inheritance
Python: Basic Inheritance
Damian T. Gordon
 
Introduction to robot framework
Introduction to robot frameworkIntroduction to robot framework
Introduction to robot framework
Chonlasith Jucksriporn
 
Continuous Quality with Postman
Continuous Quality with PostmanContinuous Quality with Postman
Continuous Quality with Postman
Postman
 
Cronjob
CronjobCronjob
Cronjob
Niraj Kumar
 
Java exception
Java exception Java exception
Java exception
Arati Gadgil
 
Robot Framework :: Demo login application
Robot Framework :: Demo login applicationRobot Framework :: Demo login application
Robot Framework :: Demo login application
Somkiat Puisungnoen
 
Php string function
Php string function Php string function
Php string function
Ravi Bhadauria
 
Learn REST API with Python
Learn REST API with PythonLearn REST API with Python
Learn REST API with PythonLarry Cai
 
Exception handling
Exception handling Exception handling
Exception handling
M Vishnuvardhan Reddy
 

What's hot (20)

Functions in Python
Functions in PythonFunctions in Python
Functions in Python
 
Literals,variables,datatype in C#
Literals,variables,datatype in C#Literals,variables,datatype in C#
Literals,variables,datatype in C#
 
Robot framework and selenium2 library
Robot framework and selenium2 libraryRobot framework and selenium2 library
Robot framework and selenium2 library
 
Selenium IDE LOCATORS
Selenium IDE LOCATORSSelenium IDE LOCATORS
Selenium IDE LOCATORS
 
Belajar Postman test runner
Belajar Postman test runnerBelajar Postman test runner
Belajar Postman test runner
 
Open mic activity logging
Open mic activity loggingOpen mic activity logging
Open mic activity logging
 
Using Postman to Automate API On-Boarding
Using Postman to Automate API On-BoardingUsing Postman to Automate API On-Boarding
Using Postman to Automate API On-Boarding
 
PHP Security
PHP SecurityPHP Security
PHP Security
 
Asp.net state management
Asp.net state managementAsp.net state management
Asp.net state management
 
Python: Basic Inheritance
Python: Basic InheritancePython: Basic Inheritance
Python: Basic Inheritance
 
Introduction to robot framework
Introduction to robot frameworkIntroduction to robot framework
Introduction to robot framework
 
Continuous Quality with Postman
Continuous Quality with PostmanContinuous Quality with Postman
Continuous Quality with Postman
 
Cronjob
CronjobCronjob
Cronjob
 
Java exception
Java exception Java exception
Java exception
 
Methods in Java
Methods in JavaMethods in Java
Methods in Java
 
Robot Framework :: Demo login application
Robot Framework :: Demo login applicationRobot Framework :: Demo login application
Robot Framework :: Demo login application
 
Php string function
Php string function Php string function
Php string function
 
Learn REST API with Python
Learn REST API with PythonLearn REST API with Python
Learn REST API with Python
 
Exception handling
Exception handling Exception handling
Exception handling
 
Api presentation
Api presentationApi presentation
Api presentation
 

Viewers also liked

Life in a Queue - Using Message Queue with django
Life in a Queue - Using Message Queue with djangoLife in a Queue - Using Message Queue with django
Life in a Queue - Using Message Queue with django
Tareque Hossain
 
Pinax Introduction
Pinax IntroductionPinax Introduction
Pinax Introduction
Daniel Greenfeld
 
Django Uni-Form
Django Uni-FormDjango Uni-Form
Django Uni-Form
Daniel Greenfeld
 
Django Forms: Best Practices, Tips, Tricks
Django Forms: Best Practices, Tips, TricksDjango Forms: Best Practices, Tips, Tricks
Django Forms: Best Practices, Tips, Tricks
Shawn Rider
 
Advanced Django Forms Usage
Advanced Django Forms UsageAdvanced Django Forms Usage
Advanced Django Forms Usage
Daniel Greenfeld
 
12 tips on Django Best Practices
12 tips on Django Best Practices12 tips on Django Best Practices
12 tips on Django Best Practices
David Arcos
 
IDMP and RIM: friend or foe?
IDMP and RIM: friend or foe?IDMP and RIM: friend or foe?
IDMP and RIM: friend or foe?eCTDconsultancy
 

Viewers also liked (7)

Life in a Queue - Using Message Queue with django
Life in a Queue - Using Message Queue with djangoLife in a Queue - Using Message Queue with django
Life in a Queue - Using Message Queue with django
 
Pinax Introduction
Pinax IntroductionPinax Introduction
Pinax Introduction
 
Django Uni-Form
Django Uni-FormDjango Uni-Form
Django Uni-Form
 
Django Forms: Best Practices, Tips, Tricks
Django Forms: Best Practices, Tips, TricksDjango Forms: Best Practices, Tips, Tricks
Django Forms: Best Practices, Tips, Tricks
 
Advanced Django Forms Usage
Advanced Django Forms UsageAdvanced Django Forms Usage
Advanced Django Forms Usage
 
12 tips on Django Best Practices
12 tips on Django Best Practices12 tips on Django Best Practices
12 tips on Django Best Practices
 
IDMP and RIM: friend or foe?
IDMP and RIM: friend or foe?IDMP and RIM: friend or foe?
IDMP and RIM: friend or foe?
 

Similar to django Forms in a Web API World

SAP Adobe forms
SAP Adobe formsSAP Adobe forms
SAP Adobe forms
Jugul Crasta
 
(ATS6-DEV02) Web Application Strategies
(ATS6-DEV02) Web Application Strategies(ATS6-DEV02) Web Application Strategies
(ATS6-DEV02) Web Application Strategies
BIOVIA
 
java mini project for college students
java mini project for college students java mini project for college students
java mini project for college students
SWETALEENA2
 
SharePoint 2013 APIs demystified
SharePoint 2013 APIs demystifiedSharePoint 2013 APIs demystified
SharePoint 2013 APIs demystified
SPC Adriatics
 
Come riprogettare le attuali farm solution di share point con il nuovo modell...
Come riprogettare le attuali farm solution di share point con il nuovo modell...Come riprogettare le attuali farm solution di share point con il nuovo modell...
Come riprogettare le attuali farm solution di share point con il nuovo modell...
Fabio Franzini
 
Server and client rendering of single page apps
Server and client rendering of single page appsServer and client rendering of single page apps
Server and client rendering of single page apps
Thomas Heymann
 
Optimizing your job apply pages with the LinkedIn profile API
Optimizing your job apply pages with the LinkedIn profile APIOptimizing your job apply pages with the LinkedIn profile API
Optimizing your job apply pages with the LinkedIn profile API
Ivo Brett
 
Prepararsi a spostare le proprie applicazioni share point su office 365
Prepararsi a spostare le proprie applicazioni share point su office 365Prepararsi a spostare le proprie applicazioni share point su office 365
Prepararsi a spostare le proprie applicazioni share point su office 365
Giuseppe Marchi
 
Building a REST API for Longevity
Building a REST API for LongevityBuilding a REST API for Longevity
Building a REST API for Longevity
MuleSoft
 
Angular 2 overview in 60 minutes
Angular 2 overview in 60 minutesAngular 2 overview in 60 minutes
Angular 2 overview in 60 minutes
Loiane Groner
 
Tutorial, Part 1: SharePoint 101: Jump-Starting the Developer by Rob Windsor ...
Tutorial, Part 1: SharePoint 101: Jump-Starting the Developer by Rob Windsor ...Tutorial, Part 1: SharePoint 101: Jump-Starting the Developer by Rob Windsor ...
Tutorial, Part 1: SharePoint 101: Jump-Starting the Developer by Rob Windsor ...
SPTechCon
 
The future of web development write once, run everywhere with angular.js and ...
The future of web development write once, run everywhere with angular.js and ...The future of web development write once, run everywhere with angular.js and ...
The future of web development write once, run everywhere with angular.js and ...
Mark Roden
 
The future of web development write once, run everywhere with angular js an...
The future of web development   write once, run everywhere with angular js an...The future of web development   write once, run everywhere with angular js an...
The future of web development write once, run everywhere with angular js an...
Mark Leusink
 
Workshop 04 android-development
Workshop 04 android-developmentWorkshop 04 android-development
Workshop 04 android-development
Aravindharamanan S
 
Write Generic Code with the Tooling API
Write Generic Code with the Tooling APIWrite Generic Code with the Tooling API
Write Generic Code with the Tooling API
Adam Olshansky
 
Z sap boe-2016-techws-04_vs_fiori-app-with-eclipseluna-accessing-zsap-system
Z sap boe-2016-techws-04_vs_fiori-app-with-eclipseluna-accessing-zsap-systemZ sap boe-2016-techws-04_vs_fiori-app-with-eclipseluna-accessing-zsap-system
Z sap boe-2016-techws-04_vs_fiori-app-with-eclipseluna-accessing-zsap-system
Nagendra Babu
 
How to Connect to Any REST API (Without Writing Any Code)
How to Connect to Any REST API (Without Writing Any Code)How to Connect to Any REST API (Without Writing Any Code)
How to Connect to Any REST API (Without Writing Any Code)
Safe Software
 
Practices and tools for building better APIs
Practices and tools for building better APIsPractices and tools for building better APIs
Practices and tools for building better APIsNLJUG
 

Similar to django Forms in a Web API World (20)

SAP Adobe forms
SAP Adobe formsSAP Adobe forms
SAP Adobe forms
 
(ATS6-DEV02) Web Application Strategies
(ATS6-DEV02) Web Application Strategies(ATS6-DEV02) Web Application Strategies
(ATS6-DEV02) Web Application Strategies
 
java mini project for college students
java mini project for college students java mini project for college students
java mini project for college students
 
SharePoint 2013 APIs demystified
SharePoint 2013 APIs demystifiedSharePoint 2013 APIs demystified
SharePoint 2013 APIs demystified
 
Come riprogettare le attuali farm solution di share point con il nuovo modell...
Come riprogettare le attuali farm solution di share point con il nuovo modell...Come riprogettare le attuali farm solution di share point con il nuovo modell...
Come riprogettare le attuali farm solution di share point con il nuovo modell...
 
Server and client rendering of single page apps
Server and client rendering of single page appsServer and client rendering of single page apps
Server and client rendering of single page apps
 
Optimizing your job apply pages with the LinkedIn profile API
Optimizing your job apply pages with the LinkedIn profile APIOptimizing your job apply pages with the LinkedIn profile API
Optimizing your job apply pages with the LinkedIn profile API
 
Prepararsi a spostare le proprie applicazioni share point su office 365
Prepararsi a spostare le proprie applicazioni share point su office 365Prepararsi a spostare le proprie applicazioni share point su office 365
Prepararsi a spostare le proprie applicazioni share point su office 365
 
Building a REST API for Longevity
Building a REST API for LongevityBuilding a REST API for Longevity
Building a REST API for Longevity
 
Angular 2 overview in 60 minutes
Angular 2 overview in 60 minutesAngular 2 overview in 60 minutes
Angular 2 overview in 60 minutes
 
Tutorial, Part 1: SharePoint 101: Jump-Starting the Developer by Rob Windsor ...
Tutorial, Part 1: SharePoint 101: Jump-Starting the Developer by Rob Windsor ...Tutorial, Part 1: SharePoint 101: Jump-Starting the Developer by Rob Windsor ...
Tutorial, Part 1: SharePoint 101: Jump-Starting the Developer by Rob Windsor ...
 
The future of web development write once, run everywhere with angular.js and ...
The future of web development write once, run everywhere with angular.js and ...The future of web development write once, run everywhere with angular.js and ...
The future of web development write once, run everywhere with angular.js and ...
 
The future of web development write once, run everywhere with angular js an...
The future of web development   write once, run everywhere with angular js an...The future of web development   write once, run everywhere with angular js an...
The future of web development write once, run everywhere with angular js an...
 
Workshop 04 android-development
Workshop 04 android-developmentWorkshop 04 android-development
Workshop 04 android-development
 
Write Generic Code with the Tooling API
Write Generic Code with the Tooling APIWrite Generic Code with the Tooling API
Write Generic Code with the Tooling API
 
Smartone v1.0
Smartone v1.0Smartone v1.0
Smartone v1.0
 
Z sap boe-2016-techws-04_vs_fiori-app-with-eclipseluna-accessing-zsap-system
Z sap boe-2016-techws-04_vs_fiori-app-with-eclipseluna-accessing-zsap-systemZ sap boe-2016-techws-04_vs_fiori-app-with-eclipseluna-accessing-zsap-system
Z sap boe-2016-techws-04_vs_fiori-app-with-eclipseluna-accessing-zsap-system
 
Code workshop
Code workshopCode workshop
Code workshop
 
How to Connect to Any REST API (Without Writing Any Code)
How to Connect to Any REST API (Without Writing Any Code)How to Connect to Any REST API (Without Writing Any Code)
How to Connect to Any REST API (Without Writing Any Code)
 
Practices and tools for building better APIs
Practices and tools for building better APIsPractices and tools for building better APIs
Practices and tools for building better APIs
 

More from Tareque Hossain

The solr power
The solr powerThe solr power
The solr power
Tareque Hossain
 
RESTful APIs: Promises & lies
RESTful APIs: Promises & liesRESTful APIs: Promises & lies
RESTful APIs: Promises & lies
Tareque Hossain
 
API Design & Security in django
API Design & Security in djangoAPI Design & Security in django
API Design & Security in django
Tareque Hossain
 
Introducing KMux - The Kernel Multiplexer
Introducing KMux - The Kernel MultiplexerIntroducing KMux - The Kernel Multiplexer
Introducing KMux - The Kernel Multiplexer
Tareque Hossain
 
SIGTRAN - An Introduction
SIGTRAN - An IntroductionSIGTRAN - An Introduction
SIGTRAN - An Introduction
Tareque Hossain
 
Linux Composite Communication
Linux Composite CommunicationLinux Composite Communication
Linux Composite Communication
Tareque Hossain
 
Django Deployment
Django DeploymentDjango Deployment
Django Deployment
Tareque Hossain
 
Xen & the Art of Virtualization
Xen & the Art of VirtualizationXen & the Art of Virtualization
Xen & the Art of Virtualization
Tareque Hossain
 
Introduction to django-config
Introduction to django-configIntroduction to django-config
Introduction to django-config
Tareque Hossain
 

More from Tareque Hossain (10)

The solr power
The solr powerThe solr power
The solr power
 
RESTful APIs: Promises & lies
RESTful APIs: Promises & liesRESTful APIs: Promises & lies
RESTful APIs: Promises & lies
 
API Design & Security in django
API Design & Security in djangoAPI Design & Security in django
API Design & Security in django
 
Introducing KMux - The Kernel Multiplexer
Introducing KMux - The Kernel MultiplexerIntroducing KMux - The Kernel Multiplexer
Introducing KMux - The Kernel Multiplexer
 
SIGTRAN - An Introduction
SIGTRAN - An IntroductionSIGTRAN - An Introduction
SIGTRAN - An Introduction
 
Django orm-tips
Django orm-tipsDjango orm-tips
Django orm-tips
 
Linux Composite Communication
Linux Composite CommunicationLinux Composite Communication
Linux Composite Communication
 
Django Deployment
Django DeploymentDjango Deployment
Django Deployment
 
Xen & the Art of Virtualization
Xen & the Art of VirtualizationXen & the Art of Virtualization
Xen & the Art of Virtualization
 
Introduction to django-config
Introduction to django-configIntroduction to django-config
Introduction to django-config
 

Recently uploaded

Generative AI Deep Dive: Advancing from Proof of Concept to Production
Generative AI Deep Dive: Advancing from Proof of Concept to ProductionGenerative AI Deep Dive: Advancing from Proof of Concept to Production
Generative AI Deep Dive: Advancing from Proof of Concept to Production
Aggregage
 
Removing Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software FuzzingRemoving Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software Fuzzing
Aftab Hussain
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
Prayukth K V
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
KatiaHIMEUR1
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Albert Hoitingh
 
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
Sri Ambati
 
Quantum Computing: Current Landscape and the Future Role of APIs
Quantum Computing: Current Landscape and the Future Role of APIsQuantum Computing: Current Landscape and the Future Role of APIs
Quantum Computing: Current Landscape and the Future Role of APIs
Vlad Stirbu
 
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
James Anderson
 
PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
ControlCase
 
Video Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the FutureVideo Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the Future
Alpen-Adria-Universität
 
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FMEEssentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
Safe Software
 
RESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for studentsRESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for students
KAMESHS29
 
A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...
sonjaschweigert1
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
Elizabeth Buie - Older adults: Are we really designing for our future selves?
Elizabeth Buie - Older adults: Are we really designing for our future selves?Elizabeth Buie - Older adults: Are we really designing for our future selves?
Elizabeth Buie - Older adults: Are we really designing for our future selves?
Nexer Digital
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
Jemma Hussein Allen
 
Introduction to CHERI technology - Cybersecurity
Introduction to CHERI technology - CybersecurityIntroduction to CHERI technology - Cybersecurity
Introduction to CHERI technology - Cybersecurity
mikeeftimakis1
 

Recently uploaded (20)

Generative AI Deep Dive: Advancing from Proof of Concept to Production
Generative AI Deep Dive: Advancing from Proof of Concept to ProductionGenerative AI Deep Dive: Advancing from Proof of Concept to Production
Generative AI Deep Dive: Advancing from Proof of Concept to Production
 
Removing Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software FuzzingRemoving Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software Fuzzing
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
 
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
 
Quantum Computing: Current Landscape and the Future Role of APIs
Quantum Computing: Current Landscape and the Future Role of APIsQuantum Computing: Current Landscape and the Future Role of APIs
Quantum Computing: Current Landscape and the Future Role of APIs
 
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
 
PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
 
Video Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the FutureVideo Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the Future
 
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FMEEssentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
 
RESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for studentsRESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for students
 
A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
Elizabeth Buie - Older adults: Are we really designing for our future selves?
Elizabeth Buie - Older adults: Are we really designing for our future selves?Elizabeth Buie - Older adults: Are we really designing for our future selves?
Elizabeth Buie - Older adults: Are we really designing for our future selves?
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
 
Introduction to CHERI technology - Cybersecurity
Introduction to CHERI technology - CybersecurityIntroduction to CHERI technology - Cybersecurity
Introduction to CHERI technology - Cybersecurity
 

django Forms in a Web API World

  • 1. XHR django Forms in an API World http://www.northwesternflipside.com/2011/01/10/2011-where-are-the-flying-cars/
  • 2. Lets talk about me Tareque Hossain Lead Software Engineer
  • 3. Lets talk about forms django Forms And how we can use them in this day & age of APIs!
  • 4. What can you expect… • What’s wrong with forms as it is • How we use forms • Issues using form in an API world • Approaches for tackling the issues • The solution
  • 5. The good old days.. • Write up some HTML • Throw some fancy template tags in there {{ my_awesome_form.as_p }} • WIN
  • 6. Fast forward a few years.. You really dig APIs
  • 7. Your setup looks like this: Me likey! I give you No $#!7. API
  • 8. Nuevo mundo.. • Django forms live on API server – Validates/ saves API requests – Doesn’t get rendered via template • You’ve been writing forms in the frontend – Hardcoded HTML – Trying to match up data that API expects
  • 9. API Clients • Your website no longer lives on the same application space as the API • Common API clients – A JavaScript MVC powered website – An android app – An iOS app
  • 10. Forms on API Clients
  • 11. The Issue • You can serve most platforms with an HTML app – Write form in HTML on your webapp • If you write native application for mobile – You recreate forms using the interfaces available
  • 12. The Issue • These interfaces you write – Don’t have any idea about the django forms residing on the API server – Only know what data to collect when you explicitly code them on each device • There’s a disconnect
  • 13. Houston we have a problem.. http://epicdemotivational.com/tag/beer/page/2/
  • 14. Lets take a step back What is a form?
  • 15. Lets take a step back ˈ rm (noun) fȯ a printed or typed document with blank spaces for insertion of required or requested information Entry #4 at http://www.merriam-webster.com/dictionary/form
  • 16. In the world of HTML Part of an HTML document with input interfaces for inserting required or requested information
  • 17. In the world of web apps • A form is the interface we provide the application user to collect information • It’s essential to any application where we collect data
  • 18. In the world of django
  • 19. django Forms • A construct that: – Binds data (request.POST) – Validates data (clean) – Processes data (save) – Renders interface (as_p)
  • 20. django Forms • ModelForm – Turns your model into a form – Easiest way to get an interface for your data • Widgets – Define specific properties for interface element – Separates presentation from data types
  • 21. Why not just render via template? You can’t if: – You only use django to power your API and the consumers are arbitrary – You run several django API servers each dealing with different data space
  • 22. Think about this architecture Profile API Analytics API Content API Admin App User App
  • 23. Your services are distributed • Web applications we design are increasingly becoming: – Separated between presentation and data layer via API – Dependent on multiple API endpoints – Rich and complex in interface
  • 24. Your services are distributed • Your site content is retrieved using the Content API – You collect user feedback on content using forms – You provide admin interface to manage content using forms
  • 25. Your services are distributed • Information for users are stored and retrieved using Profile API – You allow log in, creation and update of profiles using forms – You provide admin interface to manage profiles using forms
  • 26. Your services are distributed • Site performance and user traffic is recorded to Analytics API – You provide admin interface to access and create custom reports using forms
  • 27. Think again. Profile API Analytics API Content API Admin App User App
  • 28. The Issue (contd.) • At WiserTogether we love APIs & have a similar distributed setup • We’ve been hardcoding forms in the frontend, collecting data and sending to API
  • 29. The Issue (contd.) • Whenever a data point in the backend changed, we had to update the form • We have multiple clients who require different set of fields present on registration forms – Again, hardcoding in frontend
  • 30. It was a mess $#^*!
  • 31. What to do.. • django forms is used to validate and process our API data • We wanted django forms to determine our frontend interface – But it was completely agnostic about backend forms!
  • 32. What to do.. • Deliver form definition over API • Render interface in the frontend from the retrieved definition – No more hardcoding – Forms in the user facing application changes as soon as backend form changes
  • 33. What to do.. • Adjust form in whatever way necessary – Add/ remove fields from registration form – Frontend renders form exactly the way you want – No code change necessary in frontend
  • 34. What to do.. • Contain form definition in one spot • Allow a single central point to control interface on all applications • Allow different API consumers to retrieve form definition – And render interface appropriate for the platform or device
  • 36. Step 1 Serialize form with all information necessary for reproduction at frontend
  • 37. Step 2 • Devise methods to handle the following over API: – Deliver form definition – Receive form data – Validate form and deliver errors – If valid save the form
  • 38. Step 3 • Handle forms in the frontend using API data – Render form – Submit data – If not valid, then display errors – If valid, then display success message, reload page or redirect as necessary
  • 39. Step 1 Serialize form with all information necessary for reproduction at frontend
  • 40. django Remote Forms • Extracts all information from a given django form or model form instance • Goes through each field & widget to extract all necessary information • Presents the information as dictionary for further manipulation & easy serialization into JSON
  • 43. Step 2 • Devise methods to handle the following over API: – Deliver form definition – Receive form data – Validate form and deliver errors – If valid save the form
  • 44.
  • 45. Points to Ponder • Handle CSRF yourself of using X- CSRFToken – django CSRF middleware is not JSON friendly • Encapsulate form processing in save method, similar to Model Form
  • 46. Step 3 • Handle forms in the frontend using API data – Render form – Submit data – If not valid, then display errors – If valid, then display success message, reload page or redirect as necessary
  • 47. HTML/JS/CSS Implementation • We created a set of rendering and data handling tools for the frontend using: • In future, we’ll be working towards iOS implementations as well
  • 48. Backbone Form Handler • Renders forms based on definition received over API • Uses Handlebars template for rendering: – Core form structure (form tag, fields container, global errors) – Field & widget structure (help text, errors) • Error rendering
  • 49. Backbone Form Handler • Allows instant validation – Similar to autocomplete – Field can be validated as soon as you move to next one • Allows preloading of data • Disallow editing of fields – Including selects, radio and checkboxes • Provide submit buttons (if not supplied)
  • 50. Handlebars Templates Handlebars Widgets
  • 51. Sample Backbone View Instantiate form model Instantiate form view Initiate rendering by fetching the form definition
  • 52.
  • 53. django Remote Admin • A reviewer expressed interest – Use remote forms to expose django admin interface over API • So I implemented a set of API endpoints – Exposes django admin app/model/instance data – Exposes admin forms • And wrote a backbone app implementing django admin
  • 54. Goals of django Remote Admin • Allow administration of django projects over API • No more ties to the same old interface! • Use awesome Handlebars snippets of your own to spice up the interface
  • 55. How does it work? • Cycle through admin site registry – Extract app/model info and expose over API • Create ModelForm from the model – Expose over API using django remote forms • The backbone app calls the API – Allows browsing apps/ models – Allows creating/editing model instances
  • 56. Further Work • django Remote Forms – Implement file/ image uploading over API • django Remote Admin – Load form/widget customizations from Admin classes – Implement pagination for foreign key loader
  • 57. Demo • Ask me about WiserTogether – github.com/WiserTogether/django-remote-forms – github.com/tarequeh/django-remote-admin • Follow my tweets @tarequeh • Shout out to Carlo Costino • ind this presentation – slideshare.net/tarequeh
  • 58. Q/A • Ask me about WiserTogether – github.com/WiserTogether/django-remote-forms – github.com/tarequeh/django-remote-admin • Follow my tweets @tarequeh • Shout out to Carlo Costino • ind this presentation – slideshare.net/tarequeh

Editor's Notes

  1. We are a small health care startup and we provide a platform through which users can make better decisions about their healthcare options
  2. But we are here today to talk about forms, particularly django forms.
  3. I’ll discuss the following things..
  4. Remember the times when the only form on your site was a comments page?
  5. Here we see He-Man riding warrior pony serving API using django and says I give you API! And all the consumers love it
  6. But the problem of reproducing forms on the frontend is much more than not being able to render it via django template
  7. Here’s a clear manifestation of forms on different platforms. On the far right we have the login/registration form on Twitter’s homepage, which is strikingly similar to the interfaces on these devices!
  8. So let’s get back to the issue of form rendering
  9. This is a simple authentication form that asks for your email and password, has a few clean methods to distill the data and some additional helper methods
  10. LOVE django forms
  11. ModelForms and Widgets are two great aspect of django, one promotes DRY and the other provides separation of logic
  12. And much more
  13. 3 independent django projects and 2 independent webapps
  14. And much more
  15. And much more
  16. And much more
  17. And much more
  18. And much more
  19. More hardcoding to accommodate different versions of the same form
  20. More hardcoding to accommodate different versions of the same form
  21. More hardcoding to accommodate different versions of the same form
  22. Let’s go over each of the steps in detail..
  23. And our solution…
  24. I want to emphasize on the fact that I’m not a big fan of sending HTML over API. Particularly not for forms, since the consumer of the API may or may not render the form using HTML
  25. Lets take a look at what a view capable of providing such API functionalities look like. I promise it’s not too complex.
  26. Finally step 3
  27. So we went ahead and implemented a solution for the web applications
  28. The primary construct that’s responsible for managing the remote forms is a special Backbone model/view combo that we call the Backbone Form Handler
  29. Lets take a look at the handelbars part of this solution
  30. As you can see, we are using little snippets of Handlebars for different form fields. Similar to form widgets.
  31. More hardcoding to accommodate different versions of the same form
  32. Please feel free to use the examples in any way that suits your needs. They are not meant to be out of the box solution and currently doesn’t have much documentation
  33. Please feel free to use the examples in any way that suits your needs. They are not meant to be out of the box solution and currently doesn’t have much documentation