ccf02fa316
* chore: util to manage URLs in the codebase * docs: mentiion validate_links and supported_versions in docs * refactor: fix linter errors
3.5 KiB
It is strongly recommended to read this section before using django-components in production.
Static files
TL;DR: No action needed from v0.100 onwards. Before v0.100, use safer_staticfiles to avoid exposing backend logic.
Components can be organized however you prefer. That said, our prefered way is to keep the files of a component close together by bundling them in the same directory.
This means that files containing backend logic, such as Python modules and HTML templates, live in the same directory as static files, e.g. JS and CSS.
From v0.100 onwards, we keep component files (as defined by
COMPONENTS.dirs
and COMPONENTS.app_dirs)
separate from the rest of the static
files (defined by STATICFILES_DIRS). That way, the Python and HTML files are NOT exposed by the server. Only the static JS, CSS, and
other common formats.
!!! note
If you need to expose different file formats, you can configure these with
[`COMPONENTS.static_files_allowed`](../reference/settings.md#django_components.app_settings.ComponentsSettings.static_files_allowed)
and [`COMPONENTS.static_files_forbidden`](../reference/settings.md#django_components.app_settings.ComponentsSettings.static_files_forbidden).
Static files prior to v0.100
Prior to v0.100, if your were using django.contrib.staticfiles to collect static files, no distinction was made between the different kinds of files.
As a result, your Python code and templates may inadvertently become available on your static file server. You probably don't want this, as parts of your backend logic will be exposed, posing a potential security vulnerability.
From v0.27 until v0.100, django-components shipped with an additional installable app django_components.safer_staticfiles.
It was a drop-in replacement for django.contrib.staticfiles.
Its behavior is 100% identical except it ignores .py and .html files, meaning these will not end up on your static files server.
To use it, add it to INSTALLED_APPS and remove django.contrib.staticfiles.
INSTALLED_APPS = [
# 'django.contrib.staticfiles', # <-- REMOVE
'django_components',
'django_components.safer_staticfiles' # <-- ADD
]
If you are on an pre-v0.27 version of django-components, your alternatives are:
- a) passing
--ignore <pattern>options to the collecstatic CLI command, - b) defining a subclass of StaticFilesConfig.
Both routes are described in the official docs of the staticfiles app.
Note that safer_staticfiles excludes the .py and .html files for collectstatic command:
python manage.py collectstatic
but it is ignored on the development server:
python manage.py runserver
For a step-by-step guide on deploying production server with static files, see the demo project.
See the older versions of the sampleproject for a setup with pre-v0.100 version.