Stack Overflow in Django with Basic Auth

Stack Overflow in Django with Basic Auth can occur when HTTP Basic Authentication is used without additional protections, and an attacker induces a victim’s browser to make repeated authenticated requests to a sensitive endpoint. Because Basic Auth sends credentials with every request via an Authorization: Basic header, a malicious page can leverage an authenticated session to trigger high-rate, resource-intensive operations that consume server memory or database connections, effectively causing a denial of service through resource exhaustion.

In Django, this becomes notable when Basic Auth is applied to views or viewsets that perform unbounded or expensive queries (e.g., listing large datasets, generating reports, or walking deep relationship graphs). If the view lacks rate limiting, pagination, or query cost controls, an attacker can craft URLs that cause the backend to perform heavy joins or return very large payloads. Because Basic Auth credentials are long-lived until explicitly cleared, a victim who remains authenticated on a shared or compromised browser can unintentionally participate in such an attack.

Consider an endpoint that returns a full table export without limits:

from django.http import JsonResponse
from myapp.models import Record

def export_records(request):
    # Danger: no pagination, no size limit
    records = Record.objects.all().values()
    return JsonResponse(list(records), safe=False)

If this view is protected only by HTTP Basic Auth, an authenticated attacker who can induce the victim’s browser to request this endpoint can trigger a Stack Overflow-like condition on the server due to memory pressure from large serialized responses. This is not a classic Python recursion overflow, but a resource exhaustion scenario where the server struggles to allocate memory for very large responses. The issue is compounded when CORS allows cross-origin requests and the authentication header is automatically sent, enabling an external page to make repeated authenticated calls.

Django’s built-in authentication does not prevent this by itself; Basic Auth provides identity but not protection against abusive authenticated actions. Without additional checks—such as request rate limits, query constraints, or output size caps—the combination of a high-impact endpoint and Basic Auth can expose a denial-of-service vector that appears as a Stack Overflow symptom in logs due to memory or connection pool exhaustion.

To mitigate Stack Overflow risks and abuse with Basic Auth in Django, apply layered controls: limit payload size, enforce pagination, add rate limiting, and scope queries. Below are concrete, secure patterns.

1. Use pagination to bound response size

Never return unbounded result sets. Django REST Framework (DRF) provides built-in pagination; if using plain views, enforce limits manually.

from django.http import JsonResponse
from django.core.paginator import Paginator
from myapp.models import Record

def export_records_paginated(request):
    page = request.GET.get('page', 1)
    page_size = min(int(request.GET.get('page_size', 100)), 500)  # cap page size
    queryset = Record.objects.all().values('id', 'name')
    paginator = Paginator(queryset, page_size)
    try:
        page_obj = paginator.page(page)
    except Exception:
        return JsonResponse({'error': 'Invalid page'}, status=400)
    return JsonResponse({
        'page': page_obj.number,
        'page_size': page_obj.paginator.per_page,
        'count': page_obj.paginator.count,
        'results': list(page_obj.object_list),
    })

2. Apply rate limiting per authenticated identity

Track requests per Basic Auth user and enforce a ceiling. A simple in-memory or cache-backed approach using Django cache:

import time
from django.core.cache import caches
from django.http import JsonResponse, HttpResponseForbidden

cache = caches['default']

def rate_limited_view(request):
    if not request.user or request.user.is_anonymous:
        return HttpResponseForbidden('Authentication required')
    key = f'rate_limit:{request.user.username}'
    now = time.time()
    # allow 30 requests per minute per user
    window = 60
    limit = 30
    try:
        count, last = cache.get(key, (0, now))
        if now - last > window:
            count = 0
        if count >= limit:
            return HttpResponseForbidden('Rate limit exceeded')
        cache.set(key, (count + 1, now), timeout=window)
    except Exception:
        # fallback: allow request if cache is unavailable
        pass
    # proceed with safe, paginated logic
    return JsonResponse({'status': 'ok'})

3. Validate and constrain query parameters

Ensure filters and lookups cannot produce prohibitively large joins. Reject or page large exports explicitly.

from django.http import JsonResponse, HttpResponseBadRequest

def safe_records(request):
    max_limit = 200
    try:
        limit = int(request.GET.get('limit', 20))
        if limit <= 0 or limit > max_limit:
            return HttpResponseBadRequest(f'limit must be between 1 and {max_limit}')
    except ValueError:
        return HttpResponseBadRequest('limit must be an integer')
    records = Record.objects.all()[:limit]
    return JsonResponse(list(records.values('id', 'title')), safe=False)

4. Use HTTPS and avoid Basic Auth for browser-based clients

Basic Auth over HTTP exposes credentials. In web applications, prefer session or token-based auth. If you must use Basic Auth, ensure it is only over HTTPS and consider short-lived credentials.

5. Middleware or decorator to enforce safe patterns

A reusable decorator can combine pagination and rate checks:

from functools import wraps
from django.http import JsonResponse

def safe_api(view_func):
    @wraps(view_func)
    def _wrapped(request, *args, **kwargs):
        if not request.user.is_authenticated:
            return JsonResponse({'error': 'Unauthorized'}, status=401)
        # additional checks like rate limiting can be applied here
        return view_func(request, *args, **kwargs)
    return _wrapped

@safe_api
def my_view(request):
    # view logic with enforced pagination
    page = request.GET.get('page', 1)
    page_size = min(int(request.GET.get('page_size', 50)), 100)
    # ... safe query logic
    return JsonResponse({'data': []})