I am building a library website (sort of) based on django but I'm getting lost in the security paradigm.

The user can choose a book from the system library or upload their own books. The book is then added to their projects for them to embelish. The library is public but user uploaded content isn't.

Right now, I created an extra microservice for the upload only as (correct me if I'm wrong) the file could be malicious and break my container (DDOS). So the main app gets the file, validates some aspects of it, saves it to the database, sends the extraction task to celery, and now i'm stuck (probably will callback another user content app). The directory where the file is saved is a docker shared volume. Is this the way to go?

If it is, the problem is how do I serve the user uploaded books? Should I create a new database/app? I don't really want to expose the library app to a "add book info" route as it could be dangerous too. How do I merge the library and user uploaded books in the user's project dashboard?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.