I am building a website with the Flask framework. One functionality of the site will be that users can send messages to each other.
I created a prototype of this using
Flask WTF forms. The basic implementation is as follows:
- User lands on messaging page and chooses recipient
- User sends message via form
- Form is handled by endpoint
- Message is stored on the backend's database
Here are some limitations and considerations I can think of:
- this system is not "live", i.e.: users have to refresh page to see new messages
- users can't see if the other user is typing (not a massive deal breaker in my use case)
- figuring out the recipient with JS could have security violations (?)
- a massive influx of messages can bring down the whole backend since the messaging system is not decoupled from it
- notifying users of a new message / marking message as read will have to be done via JS which again could have security implications (?)
As you can see, I am mostly worried about using JS to handle some of this, as I am not very familiar with how to do it in such a way that it can't be maliciously manipulated (e.g.: users attempting to access messages not intended for them / sending messages to users they are not allowed to, etc.)
The other concern is that the system is not decoupled.
After building this prototype, I actually began considering paying for a service like Twilio to handle this part of the website, but I would like to see if I can build it myself.
What other problems might I face and how can I address these concerns?