Run django-debug-toolbar all the time?

[antidipyramid]

Background

How feasible is it to run django-debug-toolbar all the time, with access limited to admins on production?

Proposal

What shape do you want your R&D to take? Focus on the big picture: What tasks you want to accomplish, what questions you want to answer.

Deliverables

What artifacts will you produce from your R&D? How will we know when you're done?

Timeline

How long do you expect this R&D to take? What could cause you to need more or less time?

[xmedr]

There is a setting that is always applied to the debug toolbar SHOW_TOOLBAR_CALLBACK that determines when the toolbar should show.

The default checks are that DEBUG must be set to True and the IP of the request must be in INTERNAL_IPS. You can provide your own function callback(request) which returns True or False.

This means that this callback is mostly what controls whether the toolbar "shows". In this context, it looks like if it isn't showing, then it isn't running. I tested the callback in my local metro instance by using this - based off of a couple SO answers, first and second. This made the toolbar only show for logged in users, or if debug was on:

# settings.py
def show_toolbar(request):
    return DEBUG or (not request.is_ajax() and request.user.id)

DEBUG_TOOLBAR_CONFIG = {
    'SHOW_TOOLBAR_CALLBACK': 'projectname.settings.show_toolbar',
    # Rest of config
}

And then we'd just have to always allow the debug_toolbar urls to be included in the project, instead of conditionally based on the DEBUG status.

I see some posts about potential security risks with having the toolbar on, but none of them say what those risks are. The debug toolbar docs mention the possibility of executing arbitrary SQL using the panel if someone knows the SECRET_KEY, which is true, but with the code snippet above, prod access to the toolbar would be limited to only logged in users, and could be refined further if we assign superuser status to DataMade logins on a site, and not do the same to other users. If there are other concerns, I'd definitely want to hear them out!