title: Django view security and best-practices
body: <p>I've recently begun working on Django and now my app is nearing completion and i've begun to wonder about security and best-practices.</p>
  
  <p>I have view that generates a page and different functions in the page post AJAX requests to individual views. For example, I have a view called show_employees and I can delete and update employees by passing an an post request to the views delete_employee and update_employee.</p>
  
  <ol>
  <li><p>I've put @login_required decorators before each of these views since I don't want anyone accessing them without being authenticated. Is this okay?</p></li>
  <li><p>In the delete_employee and update_employee views, I only respond to request if it is an AJAX POST request (uisng is_ajax()). Is this okay?</p></li>
  <li><p>I return a 'success' when the view succeeds in doing what is needed and an error when there is a Validation error in my form but I'm still not handling other exceptions. How should I do this? Should i return standard 500 page through an AJAX response like <a href="https://stackoverflow.com/questions/199099/how-to-manage-a-redirect-request-after-a-jquery-ajax-call/1534662#1534662">this</a> by wrapping the view with a try-except block to handle all exceptions?</p></li>
  <li><p>Is there anything else I can do secure my view?</p></li>
  </ol>
  
  <p>Here's a sample view of mine:</p>
  
  <pre><code>    @login_required
      def add_site(request):
          data = {}
          if request.method == 'POST':
              if request.is_ajax():
                  form = AddSiteForm(request.user, request.POST)
                  if form.is_valid():
                      site = form.save(commit=False)
                      site.user = request.user
                      site.save()
                      data['status'] = 'success'
                      data['html'] = render_to_string('site.html', locals(), context_instance=RequestContext(request))
                      return HttpResponse(simplejson.dumps(data), mimetype='application/json')
                  else:
                      data['status'] = 'error'
                      data['errors'] = {}
                      for field, error in form.errors.iteritems():
                          data['errors']['id_'+field] = strip_tags(unicode(error))
                      return HttpResponse(simplejson.dumps(data), mimetype='application/json')
  </code></pre>
  
  <p>Thank you.</p>