Why is using thread locals in Django bad?

by

I disagree entirely. TLS is extremely useful. It should be used with care, just as globals should be used with care; but saying it shouldn’t be used at all is just as ridiculous as saying globals should never be used.

For example, I store the currently active request in TLS. This makes it accessible from my logging class, without having to pass the request around through every single interface–including many that don’t care about Django at all. It lets me make log entries from anywhere in the code; the logger outputs to a database table, and if a request happens to be active when a log is made, it logs things like the active user and what was being requested.

If you don’t want one thread to have the capability of modifying another thread’s TLS data, then set your TLS up to prohibit this, which probably requires using a native TLS class. I don’t find that argument convincing, though; if an attacker can execute arbitrary Python code as your backend, your system is already fatally compromised–he could monkey patch anything to be run later as a different user, for example.

Obviously, you’ll want to clear any TLS at the end of a request; in Django, that means clearing it in process_response and process_exception in a middleware class.

More Related Contents:

  1. No module named pkg_resources
  2. DRF: Simple foreign key assignment with nested serializers?
  3. How do I get user IP address in django?
  4. Is there a list of Pytz Timezones?
  5. Performing a getattr() style lookup in a django template
  6. How do I include related model fields using Django Rest Framework?
  7. Where’s my JSON data in my incoming Django request?
  8. Include intermediary (through model) in responses in Django Rest Framework
  9. Django ModelForm for Many-to-Many fields
  10. How do I do a not equal in Django queryset filtering?
  11. Get Timezone from City in Python/Django
  12. How to replace Django’s primary key with a different integer that is unique for that table
  13. multiple django sites with apache & mod_wsgi
  14. How can I get the domain name of my site within a Django template?
  15. Django 1.7 – “No migrations to apply” when run migrate after makemigrations
  16. How to encode UTF8 filename for HTTP headers? (Python, Django)
  17. ‘NOT NULL constraint failed’ after adding to models.py
  18. Django: How to build a custom form widget?
  19. “_set” in a queryset object in Django
  20. Nested inlines in the Django admin?
  21. How to set ForeignKey in CreateView?
  22. Django-tastypie: Any example on file upload in POST?
  23. Naming Python loggers
  24. Running a specific test case in Django when your app has a tests directory
  25. Change a Django form field to a hidden field
  26. Making django server accessible in LAN
  27. Django Admin: Using a custom widget for only one model field
  28. Generic many-to-many relationships
  29. Embedding a Plotly chart in a Django template
  30. How to store a dictionary on a Django Model?

Leave a Comment