Views & Responses

A Django function view takes the HttpRequest first, plus the URL's captured values as keyword arguments, and returns an HttpResponse or raises an exception Django maps to one. Returning None makes Django raise ValueError, surfacing as a 500.

Django fills request.FILES only for a POST request whose form used enctype="multipart/form-data" and actually sent a file. Without that enctype the browser sends only the file name as text, so FILES stays empty.

Function view decorators expect request as the first argument, but a method receives self first, so the decorator inspects the wrong object. method_decorator adapts the decorator to methods; apply it to dispatch() or to the class with name="dispatch".

Function views win for bespoke flows, one-off endpoints and readability; generic class-based views win when a page matches a standard list, detail or form pattern or when many views share behaviour through mixins. Both satisfy the same request-in, response-out contract.

request.POST only holds form data: Django parses it for POST requests with form-urlencoded or multipart bodies. A JSON body lands in request.body as bytes, which the view parses with json.loads() after checking request.content_type.

JsonResponse accepts only a dict by default (safe=True) because of an old JSON-array hijacking attack. Passing safe=False allows a list or any other JSON-serializable value as the top-level body.

A QueryDict stores a list per key: indexing and get() return the last value, getlist() returns all of them. request.GET and request.POST are immutable, so changes raise AttributeError; call copy() to get a mutable version.

Call response.set_cookie(key, value, max_age=...) on the response you return, then read it from request.COOKIES on later requests. Remove it with response.delete_cookie(key), using the same path and domain it was set with.

They add header names to the response's Vary header after the view runs, merging with any existing value. A view needs them when its output depends on a request header or cookie that no Django middleware already declares.

render() runs render_to_string() with the request and wraps it in an HttpResponse; redirect() resolves a model, URL name or URL into a 302; get_object_or_404() calls .get() on a Model, Manager or QuerySet and turns DoesNotExist into Http404.

request.META is the raw server environment: headers appear as HTTP_X_SIGNATURE alongside variables like REMOTE_ADDR. request.headers is a case-insensitive mapping of HTTP headers only, read as request.headers['X-Signature'].

FileResponse streams a binary file-like object in blocks, closes it afterwards, and sets Content-Length, Content-Type and Content-Disposition from the file where it can. as_attachment=True and filename control whether the browser downloads it and under what name.

render() produces an HttpResponse whose body is already rendered, while TemplateResponse keeps the template and context and renders only after the view returns. Decorators, middleware and tests can change or inspect them before rendering.

UploadedFile.read() loads the whole file into memory, while chunks() yields it in 64 KiB pieces, so writing a large upload chunk by chunk keeps memory flat. For an InMemoryUploadedFile, chunks() yields the whole content once, since it is already in memory.

FILE_UPLOAD_HANDLERS runs MemoryFileUploadHandler first: if the whole request is at most FILE_UPLOAD_MAX_MEMORY_SIZE (2.5 MB), files become InMemoryUploadedFile objects; otherwise TemporaryFileUploadHandler writes TemporaryUploadedFile objects to disk. The setting is a threshold, not a size limit.

Decorate the view with condition(etag_func=..., last_modified_func=...) using cheap callbacks that take the view's arguments; on a matching conditional GET Django returns 304 without calling the view. Use one condition() rather than stacked etag() and last_modified(), and keep vary or cache_control decorators above it.

Keep only HTTP work in the view: read input, check access, call one domain function, choose the response. Move single-object rules into model or QuerySet methods and multi-model operations into a plain service function that takes no request and raises domain exceptions.

build_absolute_uri() joins request.scheme, get_host() and the path as the app server saw them. The proxy spoke plain HTTP, so is_secure() is False, and without SCRIPT_NAME or FORCE_SCRIPT_NAME Django knows no prefix, so reverse() and request.path omit /payments.

Return a StreamingHttpResponse over a generator that yields CSV rows built with csv.writer and QuerySet.iterator(), so memory stays flat and bytes flow early. You lose Content-Length, ETags, caching and the chance to change the status mid-stream.

No Django setting caps a single file's size: DATA_UPLOAD_MAX_MEMORY_SIZE excludes file parts, and FILE_UPLOAD_MAX_MEMORY_SIZE only picks memory or disk. Cap it at the web server, with a custom upload handler, or by validating size after receipt.

preserve_request=True switches HttpResponseRedirect from 302 to 307 and HttpResponsePermanentRedirect from 301 to 308, telling the client to repeat the same method and body. Use it when redirecting a non-GET request, such as a moved POST endpoint.

Since Django 5.0 the built-in view decorators detect async def views and return an async wrapper, so the view stays a coroutine function. condition() still calls its etag and last-modified callbacks synchronously, so they cannot be async or use the sync ORM.

Subclass FileUploadHandler, implement receive_data_chunk() and file_complete(), and insert an instance into request.upload_handlers at the start of the view. Parsing request.POST or request.FILES freezes the list, and CsrfViewMiddleware reads POST first, so the view needs csrf_exempt plus an inner csrf_protect.