Click any module to expand. This module teaches Django REST Framework (enterprise standard) AND FastAPI (the fastest-growing Python framework) — students learn both. The frontend uses React 19 with TypeScript and Vite. Django Templates are taught only as context — the real frontend is React.
Project setup, models, ORM, and building REST APIs with Django REST Framework
django-admin startproject, startapp. Project structure: settings.py, urls.py, wsgi/asgi.py. Apps as modules: models.py, views.py, serializers.py, urls.py. Virtual environments (venv/pipenv/poetry). requirements.txt and pyproject.toml. Django 5.x new features: simplified form rendering, async view improvements.
Model definition: CharField, IntegerField, DateTimeField, ForeignKey, ManyToManyField. Relationships: one-to-many (ForeignKey), many-to-many, one-to-one. Meta class: ordering, unique_together, verbose_name. Custom model managers. QuerySet API: filter(), exclude(), annotate(), aggregate(), select_related(), prefetch_related(). The N+1 problem and how select_related/prefetch_related fixes it.
makemigrations → migrate workflow. Migration files: what they contain, why they're version-controlled. Data migrations (RunPython). Squashing migrations. Rolling back migrations. Why migrations matter: schema changes are versioned, repeatable, team-safe. Conflicts and how to resolve them. Django's migration system vs Flyway/Alembic — Django's is built-in and excellent.
DRF installation and setup. Serializers: ModelSerializer, nested serializers, validation (validate_field, validate). ViewSets: ModelViewSet (CRUD in one class), custom actions (@action decorator). Routers: DefaultRouter auto-generates URL patterns. Browsable API (DRF's built-in API explorer). Pagination: PageNumberPagination, LimitOffsetPagination. Filtering: django-filter integration, SearchFilter, OrderingFilter.
Serializer validation: field-level (validate_email), object-level (validate), custom validators. raise serializers.ValidationError with structured errors. Custom exception handler: override DRF's default to return consistent error format. HTTP status codes: 400 (validation), 401 (auth), 403 (permission), 404 (not found), 500 (server). Error response contract with the frontend team.
Django admin: register models, customise list_display, list_filter, search_fields. ModelAdmin for advanced customisation: inline editing, custom actions, fieldsets. django-admin-interface for modern admin UI. Django shell (manage.py shell_plus): interactive ORM queries for debugging. Admin is a PRODUCTIVITY TOOL — not a customer-facing UI. Use it for data management during development.
django-environ: load settings from .env files. Separate settings: base.py, development.py, production.py. SECRET_KEY, DEBUG, ALLOWED_HOSTS, DATABASE_URL from environment variables. Never commit secrets to Git. python-decouple as an alternative. The 12-Factor App pattern applied to Django. Why settings.py with hardcoded values breaks in production.
JWT auth, role-based access, social login, and securing Django APIs
Django's built-in auth: User model, authenticate(), login(), logout(). Custom User model (AbstractUser or AbstractBaseUser) — always create a custom User model from day one. Password hashing with PBKDF2/bcrypt/Argon2. User registration with email verification. Why Django's auth is battle-tested and extensible.
Token-based auth: access token (short-lived, 5–30 min) + refresh token (long-lived, 7 days). Login flow: POST /api/auth/login → validate → return access + refresh tokens. Token refresh: POST /api/auth/refresh → return new access token. Token blacklisting for logout. Custom claims in JWT payload. Frontend integration: store tokens, attach Authorization header.
DRF permissions: IsAuthenticated, IsAdminUser, AllowAny. Custom permissions: IsOwner (user can only edit their own objects). Object-level permissions. Groups and group-based permissions. @permission_classes decorator on viewsets. Permission hierarchy: admin > moderator > user. How to structure permissions for multi-role applications.
django-allauth or dj-rest-auth for social authentication. Google OAuth2 flow: redirect → Google consent → callback → create/login user. GitHub OAuth2 for developer-focused apps. Connecting social accounts to existing user accounts. When to use social login vs email/password (consumer apps → social, enterprise → email/password).
CSRF protection (Django's middleware). XSS prevention (Django's template auto-escaping). SQL injection prevention (ORM parameterised queries — never use raw SQL with user input). CORS configuration: django-cors-headers for React frontend. Rate limiting with django-ratelimit or DRF throttling. Security headers: HSTS, X-Content-Type-Options, X-Frame-Options. OWASP Top 10 awareness.
The fastest-growing Python framework — async, auto-docs, and type-safe
pip install fastapi uvicorn. First endpoint: @app.get("/"). Path parameters, query parameters, request body (Pydantic models). Automatic API documentation: /docs (Swagger UI) and /redoc. Async by default: async def endpoints with await. Type hints as contracts — FastAPI validates automatically from types. Why FastAPI is 3–10x faster than Django for API-heavy workloads.
Pydantic v2: BaseModel for request/response schemas. Field validation: Field(min_length=1, max_length=100). Custom validators with @field_validator. Nested models. Optional fields. Model inheritance. Pydantic vs DRF Serializers: Pydantic is faster, type-safe, and reusable outside FastAPI. Response models: response_model parameter controls what's returned.
SQLAlchemy ORM: declarative models, sessions, queries. Async SQLAlchemy (2.0 style). Alembic for migrations: alembic init, alembic revision --autogenerate, alembic upgrade head. Dependency injection: get_db session per request. Repository pattern for database operations. When to use SQLAlchemy (FastAPI) vs Django ORM (Django) — each is excellent in its ecosystem.
OAuth2PasswordBearer for JWT authentication. Dependency injection for current_user. Custom middleware for logging, timing, CORS. Background tasks: BackgroundTasks for fire-and-forget operations. WebSocket support in FastAPI. When to choose FastAPI (microservices, ML serving, high-performance APIs) vs Django (full-featured web apps, admin panel, ORM).
Production features beyond CRUD — task queues, caching, file handling, and notifications
Why task queues: don't block the request thread for slow operations (email, reports, image processing). Celery setup: broker (Redis), worker, beat (scheduled tasks). @shared_task decorator. Calling tasks: .delay() and .apply_async(). Monitoring: Flower dashboard. Use cases: send welcome email after registration, generate PDF report, process uploaded images. The #1 Django production tool after DRF.
django-redis for cache backend. @cache_page for view-level caching. Low-level cache: cache.get(), cache.set() for custom caching logic. Cache invalidation strategies: TTL, manual invalidation on write. Redis as session backend (faster than database sessions). Redis as Celery broker. When to cache: product listings, user profiles, API responses for read-heavy data.
Django FileField and ImageField. File validation: size limits, allowed types. Local storage during development. django-storages + boto3 for AWS S3 in production. Serving media files: WhiteNoise for static, S3/CloudFront for media. Image processing: Pillow for thumbnails, format conversion. Profile picture upload flow: React form → multipart POST → Django saves to S3 → return URL.
Django email backend: SMTP (Gmail, SendGrid, AWS SES). HTML email templates with Django's template engine. Use cases: welcome email, password reset, order confirmation. Sending via Celery (non-blocking). Email verification flow: register → send verification link → user clicks → activate account. Rate limiting email sending to avoid spam flags.
DRF: drf-spectacular for OpenAPI 3.0 auto-generation. Swagger UI and ReDoc endpoints. Schema customisation with @extend_schema. API versioning: URL-based (/api/v1/) or header-based. Deprecating old versions gracefully. FastAPI: auto-docs are built-in (the best in any framework). Why API documentation is a TEAM CONTRACT, not an afterthought.
Web fundamentals + TypeScript — the prerequisites for React development
Semantic tags, form input types, validation attributes. Accessibility: labels, ARIA, alt text. Why semantic HTML matters for SEO and screen readers. Django templates (server-rendered HTML) are taught here AS CONTEXT — the real frontend uses React. Understanding server-rendered vs client-rendered: Django templates = SSR, React = CSR.
Flexbox for component layout, CSS Grid for page layout. Responsive design with media queries. Tailwind CSS: utility-first classes, responsive modifiers (md:, lg:), dark mode, component extraction with @apply. Why Tailwind dominates modern frontend styling. Custom Tailwind config for brand colours and fonts.
let/const, arrow functions, template literals, destructuring, spread/rest, optional chaining, nullish coalescing. Array methods: map, filter, reduce. Promises, async/await, fetch API. Modules: import/export. These are the JavaScript features React uses — they're prerequisites, not optional.
Type annotations, interfaces, type aliases, generics, union types, enums. TypeScript with React: typing props, state, events, API responses. Why TypeScript is the modern standard — product companies expect it. tsconfig.json setup with Vite.
Building interactive UIs with the world's most popular frontend library
npm create vite@latest -- --template react-ts. Project structure: components/, pages/, services/, hooks/. JSX syntax. React DevTools. Hot Module Replacement. Why Vite replaced CRA: 10x faster dev server, native ESM, better build optimization.
Functional components with TypeScript props. Children props. Component composition. Key prop for lists. Conditional rendering: ternary, &&, early return. Thinking in components: break UI into reusable, testable pieces.
useState for component state. useEffect for side effects (API calls, subscriptions). Dependency array rules. Cleanup functions. useRef for DOM references. Rules of Hooks. Custom hooks: useAuth, useFetch, useDebounce.
React Context for simple global state (auth, theme). Zustand for complex state (lightweight Redux alternative). When to use Context vs Zustand vs Redux. Why Redux is often overkill.
BrowserRouter, Routes, Route, Link, NavLink. Dynamic routes with useParams. Nested routes with Outlet. Protected routes: redirect unauthenticated users. useNavigate for programmatic navigation. Route-based code splitting with React.lazy + Suspense.
Connecting frontend to backend — auth flow, API calls, forms, and real-time features
Axios with interceptors: auto-attach JWT, base URL config. React Query (TanStack Query): useQuery for GET, useMutation for POST/PUT/DELETE. Caching, background refetching, loading/error states — all handled automatically. Why React Query eliminates manual loading state management with useEffect.
Login form → POST /api/auth/login → receive tokens → store securely. AuthContext for global auth state. Axios interceptor: attach Authorization header. Protected route component. Auto-refresh tokens. Logout flow: clear tokens + redirect. The complete auth lifecycle from React to Django/FastAPI and back.
React Hook Form: register, handleSubmit, formState. Validation: required, minLength, pattern, custom validators. Error messages. File upload forms. Multi-step forms. Integration with DRF validation errors (display server-side errors inline).
Server-side pagination: page/size params → Django Paginator → React page controls. Debounced search input → API call. Multi-filter with URL query parameters. Infinite scroll vs page numbers. The pattern every admin dashboard and e-commerce site uses.
CORS: django-cors-headers configuration for React dev server. .env files: VITE_API_URL for frontend, .env for Django. Consistent error response format agreed between frontend and backend. Error interceptor in Axios → toast notifications. The "glue" that makes full-stack integration work without daily debugging.
Tailwind CSS for rapid styling. shadcn/ui for accessible component primitives. Lucide icons. Toast notifications. Loading skeletons. Dark mode. Mobile-first responsive layout. The UI toolkit that makes apps look professional without a designer.
pytest, Factory Boy, API tests, React Testing Library — proving your code works
pytest over unittest (cleaner syntax, better fixtures). pytest-django: @pytest.mark.django_db, client fixture. Factory Boy: generate test data (UserFactory, ProductFactory) instead of fixtures. APIClient for testing DRF endpoints: client.post('/api/products/', data). Testing serializers, views, permissions. Coverage reporting: pytest-cov.
TestClient from fastapi.testclient. httpx for async endpoint testing. pytest fixtures for database sessions. Dependency override: override get_db for test database. Testing validation, auth, and error responses. Why FastAPI's dependency injection makes testing clean.
React Testing Library: test behavior, not implementation. render(), screen queries, user events. Vitest as test runner (faster than Jest with Vite). MSW (Mock Service Worker): mock API responses. Testing forms, auth flows, and protected routes. Writing tests that give confidence to refactor.
When to use Django (monolith), when to add FastAPI (microservices), and how to think about architecture
Django's strength: batteries included (admin, ORM, auth, forms, migrations). Perfect for: MVPs, startups, content sites, internal tools. "Start with a monolith, split later when needed" — the pragmatic architecture advice. When Django apps within a project serve as module boundaries. Most successful companies started as monoliths (Instagram was Django).
When to break out: a service needs different performance characteristics (ML inference, real-time processing, high-throughput ingestion). FastAPI as a separate service: own database, own deployment. Communication: REST APIs, message queues (Redis/RabbitMQ). API Gateway pattern. Service discovery (conceptual). Why "microservices for everything" is usually wrong for student projects.
Database selection: PostgreSQL (relational) vs MongoDB (document) vs Redis (cache). Caching strategy: what to cache, TTL, invalidation. Message queues: Celery + Redis for async processing. Load balancing concepts. CDN for static assets. Horizontal scaling: multiple Django instances behind a load balancer. The vocabulary needed for system design interview discussions.
Ship your application — from local development to production
Dockerfile for Django: multi-stage build (builder installs deps, runtime runs). Dockerfile for React: build stage + Nginx serve stage. docker-compose.yml: Django + PostgreSQL + Redis + Celery worker + React in one command. Docker volumes for database persistence. .dockerignore for excluding node_modules, __pycache__. The "docker compose up" that runs the entire stack.
Gunicorn: production WSGI server (never use manage.py runserver in production). Uvicorn: production ASGI server for FastAPI and async Django. Nginx: reverse proxy, static file serving, SSL termination, load balancing. WhiteNoise for Django static files. Supervisor or systemd for process management. The production stack: Nginx → Gunicorn → Django → PostgreSQL.
On push: lint (ruff/flake8) → test (pytest) → build Docker image → push to registry → deploy. Parallel: backend tests + frontend tests simultaneously. Environment secrets in GitHub. Branch protection: tests must pass before merge. Why CI/CD matters: if tests pass in CI, the code works everywhere.
Railway (easiest, free tier), Render (good free tier), AWS (Elastic Beanstalk or ECS for production). Deploying Django: configure DATABASE_URL, STATIC_URL, ALLOWED_HOSTS. Deploying React: Vercel or Netlify (free). Custom domain + HTTPS. Environment variables in cloud platforms. collectstatic for Django. Database backups. "Here's the live URL" — the strongest interview statement.
Product catalog with categories, shopping cart, JWT auth, order history, Stripe/Razorpay payment integration (test mode), seller dashboard, image upload to S3, search + filtering with pagination, email notifications via Celery.
FastAPI backend serving ML model predictions, WebSocket for live data updates, React dashboard with charts (Recharts), user auth, data export (CSV/PDF), background data processing with Celery, Redis caching for expensive queries.
Rich text editor (Tiptap/Quill), multi-author blog with roles (admin/editor/reader), commenting system, tag-based navigation, image upload, SEO metadata, social login, full-text search with PostgreSQL.
Trainers build features live — from empty Django project to deployed application. Students code alongside. Every session adds a working feature.
Between sessions, students implement features on their project. Git-based workflow: push to GitHub, trainer reviews pull requests.
Trainers review code: naming, structure, security, testing. The feedback loop that transforms "works" into "works correctly and maintainably."
Every student deploys to the cloud with a live URL. The URL goes on their resume. "Here's my deployed project" wins interviews.
Instagram, Spotify, Dropbox, Pinterest — built with Django. Indian startups (Razorpay, Zomato's internal tools, CRED) use Python backends. Python's rapid development speed makes it the default choice for MVPs and scaling startups. Students who know Django + React are immediately employable at any Python-stack company.
LLM APIs, LangChain, RAG systems, ML model serving — the entire GenAI ecosystem is Python. FastAPI is the default framework for ML model deployment. A Python full-stack developer can build BOTH the AI backend and the user-facing frontend — the most valuable skill combination in 2025–26 tech hiring.
A deployed Django + React project with JWT auth, Celery tasks, and a live URL is worth more than any certificate. When an interviewer asks "Tell me about a project," students have real code on GitHub, architecture decisions to explain, and a working deployment to demo.
Django for full-featured web apps (admin, ORM, auth). FastAPI for high-performance APIs and microservices. Learning both means students can choose the right tool for any project — and discuss architectural trade-offs in interviews. "When would you use Django vs FastAPI?" — they can answer from experience, not theory.
E-305, Industrial Area, Sahibzada Ajit Singh Nagar, Punjab 160055, IN
