Purpose

The goal of this project is to support learning of the Django framework, with a primary focus on backend development. Along the way, it incorporates a variety of external services to meet different functional requirements. While the app is fundamentally backend-driven, certain advanced features—such as multi-factor authentication (MFA), donation payments, and user account deletion—introduce significant frontend complexity. As such, a solid understanding of JavaScript is recommended before exploring these sections: JavaScript Intermediate Docs

Disclaimer

I am still a learner myself. Throughout development, I encountered and had to adopt many unfamiliar methodologies, which may have introduced occasional mistakes or inconsistencies in the documentation. Nevertheless, the process has been incredibly educational, and I hope others will find value in the experience and insights shared.

Documentation & Project

To get started, simply download Django.pdf
Or open the via OneDrive: Django Tutorial 2025.pdf, and follow the instructions inside.

NOTE:

• I recommend opening the file in two-page view on a separate monitor for easier navigation.


• This project was mainly developed and tested in a Linux-based environment: RedHat family - Fedora.


• This project is built using the latest stable release of Django and up-to-date pip packages as of July 2025. All dependencies have been actively maintained to ensure compatibility, security, and modern development practices.


• This project makes extensive use of Bootstrap 5 components, which—while widely supported—may no longer be the preferred choice for building modern, scalable applications, especially given the recent shift in popularity toward Tailwind CSS.
  
  Nonetheless, I discovered several useful packages that simplified development and complemented Bootstrap's design system. They also helped streamline the documentation by saving visual and layout space, making the learning process more approachable.

Key Features

1. Login User
   
2. Register User
   
3. Models
   
4. Multi-Factor Authentication
   
5. Remove User
   
6. Chat Rooms
   
7. Payments
   
8. Errors
   
9. Contacting Support
   

More features are found within the documentation.

Login User

Logged-in users may revisit the login page to sign in as a different user; doing so will log out the current session. For accounts with MFA enabled, an OTP must be provided via authenticator app, email, or SMS. To prevent spamming, additional OTP requests are throttled with a 45-second cooldown. If required input fields from the MFA modal form are tampered with before submission (e.g. via HTML manipulation), a technical error will be displayed.

⚠️ A user's contact details—such as their phone number and email address—are masked using asterisk symbols * during MFA logging to provide minimal feedback and protect personal data.

Register User

Visiting clients can register new users and optionally set a profile image during registration. Once registered, users are authenticated automatically and redirected to the main page. From their profile page, they can update their photo, password, and other account details at any time. If no image is provided, a default template image is automatically assigned. To handle media storage efficiently, the application integrates with Amazon S3 buckets. This setup ensures profile pictures are stored securely and reliably, leveraging AWS's globally distributed, scalable infrastructure. Offloading image management to S3 also simplifies server logic and improves performance across deployments. This app can optionally protect the clients of all ages by filtering out the profiles with NSFW images using third-party service: DeepaAI Users can delete their account anytime from the profile page, giving them full control over their data and online presence.

Models

To register a new model, the user must be logged in and click the Add Model link on the main page. They will be redirected to a form to create the model. Upon successful submission, they are returned to the main page and can delete their models at any time from there. Users can search for models using the search input. Search results may include their own models as well as those created by other users. Available filters include: No creator Creator username Creator ID Country code Depending on the selected filter, an additional input field may appear. For example, selecting “Creator ID” prompts the user to provide the corresponding ID. Model creation is gated behind a reCAPTCHA challenge to prevent spam and abusive requests. This safeguard helps protect the integrity and performance of the application's services.

Models are loaded in batches of five per request via infinite scroll. Relevant models matching the search criteria are displayed first. As users scroll further, additional—possibly irrelevant—models will appear beneath the initial results.

Multi-Factor Authentication

To activate multi-factor authentication (MFA), ensure your profile includes a current mobile number and email address. Verification codes will be sent to both, and must be validated before MFA can be enabled. Users can disable MFA at any time from their profile page. Since this is a critical security setting, they will be prompted to confirm their password as a safeguard. ⚠️ MFA is currently enforced via CustomLoginView() only. Django’s default admin login bypasses this mechanism. To maintain consistent authentication security, consider routing admin login through the custom view—or disabling access to the admin panel "login" site entirely.

⚠️ This application utilizes Zoho and Twilio services to send One-Time Password (OTP) codes.

Remove User

Users can remove their account at any time from the profile page. Because this is a critical action, password confirmation is required to proceed. Upon successful verification, a feedback panel appears displaying: A countdown indicating when the account is scheduled for deletion Optional technical reassessment details, accessible via a dropdown Key instructions outlining what users should know before and after the deletion is finalized Links to the site's privacy policy and terms & conditions for reference Users may cancel the deletion schedule at any point before the countdown completes—no password verification required. Canceling the schedule resets the countdown; if reinitiated, a fresh 30-day deletion interval begins.

Account deletions are handled by a background scheduler running on a separate server. Eligible accounts are processed every 15 minutes. A secondary fallback scheduler ensures full deletion in case of interruptions or failure in the primary task. ⚠️ Once an account is deleted, it cannot be recovered—including any third-party integrations such as the associated Stripe customer account used for payments.

Chat Rooms

The platform supports real-time conversations using ASGI and WebSockets. To start a direct chat, users can visit another user's profile and click the Direct Message button located below their profile picture. If a chatroom already exists between the two users, the logged-in user is redirected there. If not, a new direct chatroom is created automatically. Users can revisit their active conversations anytime via the My Chats dropdown on their own profile page. A public chatroom also exists, but it’s not currently linked on any page. To access it manually, navigate to: localhost:8000/chat/ The same goes for accessing other users, just use: localhost:8000/users/profile/USER_ID

⚠️ Conversations are not end-to-end encrypted. Messages can be viewed via the admin panel and should not be considered private. 🗑️ Chat histories associated with deleted users are automatically removed from the system.

Payments

There are two payment flows available via Stripe: Buy Plan and Donate. Both are accessible only to authenticated users: Buy Plan: localhost:8000/buy-plan Donate: localhost:8000/donate Buy Plan Users select from predefined plans via a dropdown. Backend validation enforces the selection, ensuring secure, tamper-proof payments. Donate This page allows users to enter a custom donation amount. Key features include: Polish-language support for all labels and error messages Localized country selector with flags for enhanced UX Address input with country-aware postcode validation Postcode patterns and available countries configurable via JSON Country exclusions enforced (e.g. Russia, North Korea) Although the example image shows a full address line, this feature is disabled in the current live implementation. Developers can manually re-enable it as needed.

✅ Upon payment completion, users are greeted with a confirmation screen and may redirect themselves back to the homepage. ⚠️ Each user is tied to a Stripe customer ID. If absent, a new account is auto-generated when accessing the page—even if a prior account was unlinked.

Errors

400 Bad Request The server couldn’t understand the request due to malformed syntax. Example: Submitting a form with missing or invalid fields, or a malformed JSON payload. 403 Forbidden The server understood the request but refuses to authorize it. Example: Accessing a restricted admin page without proper credentials. 404 Not Found The requested resource couldn’t be found. Example: A mistyped URL, or visiting a deleted page. 500 Internal Server Error A generic error indicating something went wrong on the server side. Example: Unhandled exception, misconfigured middleware, or a broken database query.

⚠️ These error pages are shown only when DEBUG = False in your settings.py. When DEBUG = True, Django displays detailed debug pages instead, which are useful during development for diagnosing issues.

Contacting Support

All users — whether logged in or not — can reach the support team via the direct URL: http://localhost:8000/contact. To streamline communication, the form includes: 📝 A pre-formatted message template 🗂️ A selection of subject options to help route inquiries efficiently 📧 A required client email field so our support team can follow up with a response The contact form is protected by reCAPTCHA to block spam and automated abuse. Submissions are sent via a bot email connected to Zoho Mail, and repeated spam can trigger account suspension. That’s why keeping this protection in place is essential.

⚠️ The page is not currently linked in the UI and must be accessed manually.