Skip to content

feat: implement django silk for api performance monitoring and profiling #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ngovinh2k2 merged 1 commit into from
Jul 3, 2026
Merged

feat: implement django silk for api performance monitoring and profiling #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions bootstrap_service/settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@

DJANGO_SETTINGS_MODULE = "bootstrap_service.settings"
ROOT_URLCONF = "bootstrap_service.urls"
SILK_ENABLED = os.getenv("ENV", "dev").lower() == "dev"

@gemini-code-assist gemini-code-assist Bot Jul 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Issue: Silk Enabled During Test Runs

If the test suite is executed (e.g., via python manage.py test), the environment variable ENV will likely default to "dev", which enables Django Silk.

Running Silk during tests has several negative impacts:

  1. Performance: It significantly slows down the test suite by intercepting and saving every request and database query.
  2. Database Integrity: It attempts to write to the database, which can cause issues if the test database is not fully migrated or if tests are run in parallel.
  3. Isolation: It can pollute test runs and cause unexpected side effects.

Recommendation

Disable Silk when running tests by checking sys.argv.

Suggested change
SILK_ENABLED = os.getenv("ENV", "dev").lower() == "dev"
import sys
SILK_ENABLED = os.getenv("ENV", "dev").lower() == "dev" and "test" not in sys.argv


DEBUG = True
ALLOWED_HOSTS = ["*"]
Expand Down Expand Up @@ -113,6 +114,9 @@
ACCOUNT_USERNAME_REQUIRED = False
ACCOUNT_AUTHENTICATION_METHOD = "email"

if SILK_ENABLED:
INSTALLED_APPS.append("silk")

# Middleware configuration (required for admin application)
MIDDLEWARE = [
"django.middleware.security.SecurityMiddleware",
Expand All @@ -124,6 +128,23 @@
"django.middleware.clickjacking.XFrameOptionsMiddleware",
]

if SILK_ENABLED:
MIDDLEWARE.insert(2, "silk.middleware.SilkyMiddleware")

def silky_intercept_func(request):
return request.path.startswith("/api/")

SILKY_INTERCEPT_FUNC = silky_intercept_func
SILKY_AUTHENTICATION = False
SILKY_AUTHORISATION = False
Comment on lines +138 to +139

@gemini-code-assist gemini-code-assist Bot Jul 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

Security Risk: Unprotected Silk Console

Setting both SILKY_AUTHENTICATION and SILKY_AUTHORISATION to False allows anyone to access the Silk profiling console at /silk/console/ without logging in.

Even in a development environment, if this service is deployed to a shared or public development/staging server, this exposes sensitive information including:

  • Database queries (SQL) and execution times.
  • Request and response headers (which may contain auth tokens or session cookies).
  • Request and response bodies.

Recommendation

Enable authentication and authorization by default, or make them configurable via environment variables so that only authenticated staff/superusers can access the profiling data.

Suggested change
SILKY_AUTHENTICATION = False
SILKY_AUTHORISATION = False
SILKY_AUTHENTICATION = True
SILKY_AUTHORISATION = True

SILKY_PYTHON_PROFILER = True
SILKY_PYTHON_PROFILER_BINARY = False
SILKY_MAX_REQUEST_BODY_SIZE = 1024
SILKY_MAX_RESPONSE_BODY_SIZE = 0
SILKY_META = True
SILKY_INTERCEPT_PERCENT = 10
SILKY_MAX_RECORDED_REQUESTS_CHECK_PERCENT = 10
Comment on lines +144 to +146

@gemini-code-assist gemini-code-assist Bot Jul 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Configuration Conflict & Usability Issue

  1. Mutual Exclusivity: In Django Silk, SILKY_INTERCEPT_PERCENT and SILKY_INTERCEPT_FUNC are mutually exclusive. Defining both can lead to unexpected behavior or one overriding the other.
  2. Usability in Dev: Setting SILKY_INTERCEPT_PERCENT = 10 means only 10% of requests are intercepted. In a local development environment, developers expect 100% of their requests to be profiled so they can debug and analyze them reliably. A 10% rate will make debugging extremely confusing as most requests will be silently ignored.

Recommendation

Remove SILKY_INTERCEPT_PERCENT to rely entirely on SILKY_INTERCEPT_FUNC (which will intercept 100% of the matching /api/ requests).

Suggested change
SILKY_META = True
SILKY_INTERCEPT_PERCENT = 10
SILKY_MAX_RECORDED_REQUESTS_CHECK_PERCENT = 10
SILKY_META = True
SILKY_MAX_RECORDED_REQUESTS_CHECK_PERCENT = 10


# Internationalization
# https://docs.djangoproject.com/en/3.2/topics/i18n/
LANGUAGE_CODE = "en-us"
Expand Down
6 changes: 6 additions & 0 deletions bootstrap_service/urls.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
2. Add a URL to urlpatterns: path('blog/', include('blog.urls'))
"""

from django.conf import settings
from django.contrib import admin
from django.db import connection
from django.http import HttpResponse
Expand Down Expand Up @@ -48,6 +49,11 @@ def health_check(_):
schema_view.with_ui("swagger", cache_timeout=0),
name="schema-swagger-ui",
),
*(
[path("silk/console/", include("silk.urls", namespace="silk"))]
if settings.SILK_ENABLED
else []
),
# health
path("bootstrap/api/health", health_check),
# admin
Expand Down
3 changes: 2 additions & 1 deletion requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,5 @@ pika==1.3.2
django-redis==5.4.0
boto3==1.37.13
psycopg2-binary==2.9.9
django_tenants==3.6.1
django_tenants==3.6.1
django-silk==5.3.2
Loading