Hacker News Reader

Comment by Jean-Philipe | Hacker News Reader

I've worked with Django and nodejs as well. When working with node, I usually just grab express and some decent ORM that knows how to postgres, and I feel like I'm pretty much there. I've just never missed anything from Django.

I haven't worked with rails yet though.

View on HN

You can not say you get feature parity just after plugging an ORM to express. Of course if you're building a todolist, I understand the point, but as soon as you have more need, the journey of searching for packages, comparing them, test them, read their doc, starts. Some things I have in mind: security, authentication, file uploads, role management, testing, cache, admin, etc.

> You can not say you get feature parity just after plugging an ORM to express.

It's also not what I said :-)

Admin is a good point though. I actually do miss that when working with node.

Does your solution have protection against cross-site scripting attacks?

you can use same-site cookie attribute to prevent csrf attacks these days.

Not an ideal defense, as explained at https://portswigger.net/web-security/csrf/samesite-cookies

But there are many things the programmer can do to defend against csrf attacks. But you have to know about the problem and know how to defend against it. When I made my first Django site 20 years ago I hadn’t even heard of csrf, yet was protected against it by the framework. It has many such benefits included, so you can make a secure site while knowing little about web security. And an efficient one: it caches DB data for you, for example.

On the downside, as others have mentioned, it’s built using Python class inheritance magic, so can be a headache to modify its behavior.

Reply on news.ycombinator.com