Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

"From 'NOT NULL constraint failed' to Success: Debugging My Django DRF Order Creation API"

My Journey to a Robust E-commerce Order API Hey Dev.to community! 👋 Today marks a significant milestone in my ongoing journey to build a robust e-commerce API using Django REST Framework (DRF). As a passionate #Python and #Django de…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!




My Journey to a Robust E-commerce Order API



Hey Dev.to community! 👋



Today marks a significant milestone in my ongoing journey to build a robust e-commerce API using Django REST Framework (DRF). As a passionate #Python and #Django developer, I've been diving deep into backend development, and today's session was all about strengthening the foundation of my orders, products, and customers applications.



The core focus? Extensive Unit Testing and refining API serialization to handle complex data relationships.






The Challenge: A Mysterious IntegrityError



While testing my order creation endpoint via Swagger, I ran into a seemingly cryptic error in the console:



sqlite3.IntegrityError: NOT NULL constraint failed: orders_order.total_amount



This traceback clearly pointed to my Order model's total_amount field. The database was refusing to save an Order because total_amount was NULL, but my model definition (implicitly) required a non-null value.




Internal Server Error: /api/orders/

Traceback (most recent call last):

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\backends\utils.py", line 105, in _execute

    return self.cursor.execute(sql, params)

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\backends\sqlite3\base.py", line 329, in execute

    return super().execute(query, params)

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

sqlite3.IntegrityError: NOT NULL constraint failed: orders_order.total_amount



The above exception was the direct cause of the following exception:



Traceback (most recent call last):

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\core\handlers\exception.py", line 55, in inner

    response = get_response(request)

               ^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\core\handlers\base.py", line 197, in _get_response

    response = wrapped_callback(request, *callback_args, **callback_kwargs)

               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\views\decorators\csrf.py", line 65, in _view_wrapper

    return view_func(request, *args, **kwargs)

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\rest_framework\viewsets.py", line 124, in view

    return self.dispatch(request, *args, **kwargs)

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\rest_framework\views.py", line 509, in dispatch

    response = self.handle_exception(exc)

               ^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\rest_framework\views.py", line 469, in handle_exception

    self.raise_uncaught_exception(exc)

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\rest_framework\views.py", line 480, in raise_uncaught_exception

    raise exc

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\rest_framework\views.py", line 506, in dispatch

    response = handler(request, *args, **kwargs)

               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\rest_framework\mixins.py", line 19, in create

    self.perform_create(serializer)

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\rest_framework\mixins.py", line 24, in perform_create

    serializer.save()

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\rest_framework\serializers.py", line 208, in save

    self.instance = self.create(validated_data)

                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\orders\serializers.py", line 26, in create

    order = Order.objects.create(**validated_data)

            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\models\manager.py", line 87, in manager_method

    return getattr(self.get_queryset(), name)(*args, **kwargs)

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\models\query.py", line 679, in create

    obj.save(force_insert=True, using=self.db)

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\models\base.py", line 822, in save

    self.save_base(

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\models\base.py", line 909, in save_base

    updated = self._save_table(

              ^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\models\base.py", line 1071, in _save_table

    results = self._do_insert(

              ^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\models\base.py", line 1112, in _do_insert

    return manager._insert(

           ^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\models\manager.py", line 87, in manager_method

    return getattr(self.get_queryset(), name)(*args, **kwargs)

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\models\query.py", line 1847, in _insert

    return query.get_compiler(using=using).execute_sql(returning_fields)

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\models\sql\compiler.py", line 1823, in execute_sql

    cursor.execute(sql, params)

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\backends\utils.py", line 122, in execute

    return super().execute(sql, params)

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\backends\utils.py", line 79, in execute

    return self._execute_with_wrappers(

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\backends\utils.py", line 92, in _execute_with_wrappers

    return executor(sql, params, many, context)

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\backends\utils.py", line 100, in _execute

    with self.db.wrap_database_errors:

         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\utils.py", line 91, in __exit__

    raise dj_exc_value.with_traceback(traceback) from exc_value

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\backends\utils.py", line 105, in _execute

    return self.cursor.execute(sql, params)

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "C:\Users\Nicol\Aprendizaje\Udemy\Python\DjangoRestFramework\env\Lib\site-packages\django\db\backends\sqlite3\base.py", line 329, in execute

    return super().execute(query, params)

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

django.db.utils.IntegrityError: NOT NULL constraint failed: orders_order.total_amount

[19/Jun/2025 02:06:41] "POST /api/orders/ HTTP/1.1" 500 32475










The Diagnosis: Where Model Tests Meet API Logic



Interestingly, my dedicated unit tests for the Product and Customer models were passing perfectly. This confirmed that my models were correctly defined and behaved as expected in isolation.



For example, for the Product model, my tests covered creation, default values, __str__ representation, updates (including auto_now fields like updated_at which required a small time.sleep for accurate testing!), and deletion.



Test Customers



Se Agrego Signals.py



This led me to understand that the issue wasn't within the model itself, but rather in how the DRF serializer was processing the incoming API request data before saving it to the database. The total_amount is a calculated field (derived from order items), and my API wasn't providing an initial value.






The Solution: Smart Serialization and Initializing Values



To resolve the NOT NULL constraint violation and streamline the API's behavior, I implemented key changes in my orders/serializers.py:






1. Making Calculated Fields Read-Only



Fields like order_date, total_amount, status (for initial creation), and price_at_order are typically generated or calculated by the backend, not provided by the client. Marking them as read_only_fields in the serializer's Meta class tells DRF to ignore them during input (deserialization) but include them in the output (serialization).




# orders/serializers.py (snippet)

# ... (other imports) ...

class OrderItemSerializer(serializers.ModelSerializer):
# ...
class Meta:
model = OrderItem
fields = ['id', 'product', 'product_id', 'quantity', 'price_at_order']
read_only_fields = ['price_at_order'] # Client shouldn't provide this, it's calculated.

class OrderSerializer(serializers.ModelSerializer):
# ...
class Meta:
model = Order
fields = ['id', 'customer', 'order_date', 'total_amount', 'status', 'items']
# These fields are either auto-generated or have a default,
# so they should not be provided by the client on creation.
read_only_fields = ['order_date', 'total_amount', 'status']









2. Ensuring Initial total_amount During Order Creation



Even after making total_amount read-only, the database still required a non-null value during the Order object's instantiation. I explicitly passed a default of 0.00 when creating the Order in the serializer's create method.




# orders/serializers.py (inside OrderSerializer's create method)

import decimal # Make sure this is at the top of your file!

class OrderSerializer(...):
# ...
def create(self, validated_data):
items_data = validated_data.pop('items') # Crucial: Extract nested items data

# Initialize total_amount to 0.00 to satisfy the NOT NULL constraint.
# This is particularly important if the model itself doesn't have a default.
order = Order.objects.create(total_amount=decimal.Decimal('0.00'), **validated_data)

for item_data in items_data:
product_instance = item_data.pop('product_id')
OrderItem.objects.create(
order=order,
product=product_instance,
**item_data
)

# Note: I removed an explicit call to order.calculate_total_amount() here.
# My Django signals (post_save/post_delete on OrderItem) are already configured
# to automatically update the Order's total when its items are saved or deleted.
# This keeps the serializer lean and relies on the model's self-maintaining logic.

return order









3. Handling Nested Relationships for Read/Write



For OrderItems, I used a powerful DRF pattern:



For Reading (GET requests): I use product = ProductSerializer(read_only=True) to show detailed product information nested within the OrderItem.

For Writing (POST/PUT requests): I use product_id = serializers.PrimaryKeyRelatedField(queryset=Product.objects.all(), write_only=True) to expect just the product's ID from the client, simplifying the input payload.




# orders/serializers.py (inside OrderItemSerializer)
# Assuming ProductSerializer is correctly imported from products.serializers
from products.serializers import ProductSerializer

class OrderItemSerializer(serializers.ModelSerializer):
product = ProductSerializer(read_only=True) # Full product details on read
product_id = serializers.PrimaryKeyRelatedField( # Product ID on write
queryset=Product.objects.all(),
write_only=True
)
# ...









The Sweet Taste of Success!



After implementing these changes and restarting my server, the API calls from Swagger were finally successful!



Swagger



Swagger






My console now shows:






[19/Jun/2025 02:57:30] "POST /api/orders/ HTTP/1.1" 201 378
[19/Jun/2025 02:57:59] "GET /api/orders/ HTTP/1.1" 200 742









This journey reinforced the immense value of:



Thorough Unit Testing: Pinpointing where the issue truly lies (model vs. serializer).

Understanding DRF's Mechanics: Especially read_only_fields and custom create/update methods for nested writes.

Data Integrity: Ensuring fields meet database constraints.

Django Signals: Leveraging them for automated calculations and maintaining data consistency.

I'm incredibly grateful for the guidance received throughout this process. Every debugged error is a massive learning opportunity!






Seeking Opportunities!



I'm actively looking for junior to mid-level #Python / #Django / #BackendDeveloper roles. If you're building exciting projects and need someone passionate about clean, tested, and robust code, I'd love to connect!






Feel free to reach out and check out my work:



GitHub: https://github.com/NicolasAndresCL/API_con_DRF

LinkedIn: https://www.linkedin.com/in/nicolas-andres-cano-leal/

Thanks for reading! What are your go-to strategies for handling calculated fields in DRF, or debugging IntegrityErrors? Share your thoughts in the comments!

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - "From 'NOT NULL constraint failed' to Success: Debugging My Django DRF Order Creation API"
id: 1280c451-eee0-4fd1-b592-ea4e347c7e6d
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      DestinationHostname:
        - 'dev.to'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
  - attack.t1190
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "\"From \'NOT NULL constraint fai" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
(dest_host="dev.to")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
destination.domain: ("dev.to") and event.category: "network"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where DestinationHostName in ("dev.to")
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

IoC Intelligence (1 Indikatoren)
dev[.]to
CTI Threat Relationship Graph5 Knoten / 4 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Identifiziert: T1190Exploit Public-Facing Application
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich "From 'NOT NULL constraint failed' to Su.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten "From 'NOT NULL constraint failed' to Success: Debugging My Django DRF Order Creation API"

Thematisch verwandte Begriffe: From, NULL, constraint, failed · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100503 | Ghidra versions through 12.1.4 contain a heap use-after-free vulnerabil…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag