Django URL routing: local dispatch and parameter boundaries

Operation contract

The standalone fixture configures a minimal Django application, registers an integer receipt route and uses Django’s local test client. The view rejects zero rather than assuming an integer converter enforces a positive-ID domain. An unmatched textual ID produces 404. JsonResponse serializes the fixture record; no ORM model is installed or queried.

Failure and ownership boundary

The fixed secret is only a test placeholder in this isolated process. A deployment needs its own secret storage, host policy, middleware, identity and record authorization. This program configures settings once; real projects use a settings module and an application registry that must not be repeatedly reconfigured. Django forms: ASCII wire fields and cleaned domain values and Flask routing: application factories, converters and test clients show comparable boundaries.

Tested environment

Dependency check: this program was executed on CPython 3.14.6 with Django==5.2.17. Install these versions in a separate virtual environment. The download includes the recorded environment snapshot; no third-party package is part of the website runtime.

Working program

from django.conf import settings
settings.configure(SECRET_KEY="local-fixture-only", DEBUG=False, ROOT_URLCONF=__name__,
                   ALLOWED_HOSTS=["testserver"], INSTALLED_APPS=[], MIDDLEWARE=[])
import django
django.setup()
from django.http import JsonResponse
from django.test import Client
from django.urls import path

def receipt(request, receipt_id):
    if receipt_id <= 0:
        return JsonResponse({"error": "positive ID required"}, status=400)
    return JsonResponse({"receipt_id": receipt_id, "amount_minor": 125})

urlpatterns = [path("receipts/<int:receipt_id>/", receipt)]
client = Client()
response = client.get("/receipts/41/")
print(response.status_code, response.json())
print(client.get("/receipts/0/").status_code)
print(client.get("/receipts/missing/").status_code)

Output

200 {'receipt_id': 41, 'amount_minor': 125}
400
404

Costs and limits

The test uses one in-process application and three requests. URL dispatch timing does not establish database, middleware, network or production performance.

Common Mistakes

• A converted path value still requires a domain and authorization rule.
• Keep the test placeholder secret out of a deployed settings module.

Connected lessons

Django forms: ASCII wire fields and cleaned domain values, Flask routing: application factories, converters and test clients, Python SQLite project: transactional batches, duplicate IDs and reopen checks.

Related Python operation checks

Django templates: escape untrusted text at HTML output, Django keyset pagination: stable ordering and a bounded next page.

Follow the related contract

Django REST Framework object permissions: check the retrieved record, not only login.