# Behavior traces — django/django

> Canonical page: https://codevetter.com/unpack/django/behavior-traces

# Behavior traces — django/django

Scanned commit dd6f6b1531984823e3dc56740dfa93f3ceb09357 (2026-09-20). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Three flows dominate day-to-day work: process startup for django-admin, the per-request path from handler to view, and the persistence path from QuerySet or Model.save through SQL and migrations. Auth and CSRF are the security-critical variants of the request path. Names below are the functions actually called, in order.
- CLI startup order: execute_from_command_line -> ManagementUtility.execute -> CommandParser known-args for --settings/--pythonpath -> handle_default_options -> django.setup (configure_logging, set_script_prefix, apps.populate) -> autocomplete if DJANGO_AUTO_COMPLETE is set -> fetch_command -> load_command_class -> BaseCommand.run_from_argv -> execute (system checks unless skipped) -> Command.handle. No subcommand prints help. — [django/core/management/__init__.py#L353-440](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/management/__init__.py#L353-L440) [django/__init__.py#L8-25](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/__init__.py#L8-L25) [django/core/management/base.py#L410-471](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/management/base.py#L410-L471)
- runserver special case: if the subcommand is runserver and --noreload is absent, ManagementUtility calls autoreload.check_errors(django.setup) before the command class is loaded, and on failure pretends the app registry is ready so the reloader child can show the exception. Command.handle then inner_run via run_with_reloader, serving get_internal_wsgi_application(). — [django/core/management/__init__.py#L386-414](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/management/__init__.py#L386-L414) [django/core/management/commands/runserver.py#L71-117](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/management/commands/runserver.py#L71-L117)
- Sync HTTP order: WSGIHandler.__call__ -> signals.request_started (reset_queries, close_old_connections) -> WSGIRequest -> BaseHandler.get_response -> set_urlconf(ROOT_URLCONF) -> middleware chain -> _get_response -> resolve_request -> URLResolver.resolve -> make_view_atomic -> view(request, *args, **kwargs) -> optional process_exception -> optional TemplateResponse.render -> start_response. — [django/core/handlers/wsgi.py#L120-144](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/handlers/wsgi.py#L120-L144) [django/db/__init__.py#L46-63](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/db/__init__.py#L46-L63) [django/core/handlers/base.py#L138-228](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/handlers/base.py#L138-L228) [django/core/handlers/base.py#L302-356](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/handlers/base.py#L302-L356)
- ASGI differs at the edges: ASGIHandler serves ASGIRequest built from scope (path, method, query_string, root_path) and uses get_response_async so async views are awaited and sync views run via sync_to_async(thread_sensitive=True). body_receive_timeout is 60 seconds. — [django/core/handlers/asgi.py#L39-80](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/handlers/asgi.py#L39-L80) [django/core/handlers/base.py#L154-174](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/handlers/base.py#L154-L174) [django/core/handlers/base.py#L230-265](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/handlers/base.py#L230-L265)
- Class-based view order: URL resolver calls the callable returned by View.as_view -> view() constructs the class, calls setup (stores request/args/kwargs, aliases head to get), then dispatch, which lowercases request.method and invokes that handler or http_method_not_allowed. — [django/views/generic/base.py#L82-143](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/views/generic/base.py#L82-L143)
- Read query order: QuerySet.filter -> _filter_or_exclude -> _chain/_clone -> _filter_or_exclude_inplace -> Query.add_q(Q). Later iteration calls _fetch_all -> ModelIterable -> SQL compiler as_sql -> SQLCompiler.execute_sql -> cursor.execute. prefetch_related runs only after the primary result list exists. — [django/db/models/query.py#L1723-1757](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/db/models/query.py#L1723-L1757) [django/db/models/query.py#L2326-2330](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/db/models/query.py#L2326-L2330) [django/db/models/sql/compiler.py#L1619-1649](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/db/models/sql/compiler.py#L1619-L1649)
- Write order: Model.save -> _prepare_related_fields_for_save -> router.db_for_write -> save_base -> pre_save.send -> _save_parents (when not raw) -> _save_table -> _do_insert or _do_update -> post_save.send. asave is sync_to_async(self.save). Empty update_fields returns before signals. — [django/db/models/base.py#L847-1024](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/db/models/base.py#L847-L1024)
- migrate command order: Command.handle reads --database (default alias), builds a MigrationExecutor for that connection, plans targets, and calls executor.migrate. Forward application renders project state (state.apps) once, then apply_migration for each selected node. --fake records without running SQL. — [django/core/management/commands/migrate.py#L93-99](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/management/commands/migrate.py#L93-L99) [django/db/migrations/executor.py#L96-169](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/db/migrations/executor.py#L96-L169)
- Login order: authenticate walks AUTHENTICATION_BACKENDS, calls backend.authenticate, stops on PermissionDenied, and on total failure sends user_login_failed. ModelBackend.authenticate loads the user with get_by_natural_key and check_password_with_timing_attack_mitigation, then user_can_authenticate (is_active). login() stores the user pk and session auth hash, flushing the session if it belonged to someone else, otherwise cycle_key. — [django/contrib/auth/__init__.py#L123-188](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/contrib/auth/__init__.py#L123-L188) [django/contrib/auth/backends.py#L59-101](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/contrib/auth/backends.py#L59-L101)
- CSRF failure order on an unsafe request: process_view -> _get_secret (cookie or session) -> _check_token compares the POST or header token -> RejectRequest -> _reject -> CSRF_FAILURE_VIEW (default django.views.csrf.csrf_failure) -> log_response Forbidden. HTTPS requests also pass _origin_verified and _check_referer. — [django/middleware/csrf.py#L202-219](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/middleware/csrf.py#L202-L219) [django/middleware/csrf.py#L271-384](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/middleware/csrf.py#L271-L384) [django/conf/global_settings.py#L571-573](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/conf/global_settings.py#L571-L573)
- Password check order: check_password -> verify_password -> identify_hasher (algorithm is the prefix before $, with legacy unsalted md5/sha1 shapes) -> hasher.verify. If the preferred hasher differs or must_update, and a setter is passed, the password is re-encoded. Missing users still run make_password once to reduce timing differences. — [django/contrib/auth/hashers.py#L39-118](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/contrib/auth/hashers.py#L39-L118) [django/contrib/auth/hashers.py#L172-191](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/contrib/auth/hashers.py#L172-L191)
- System-check order inside a command: BaseCommand.execute, when requires_system_checks and not skip_checks, calls self.check, then check_migrations if required, then handle. call_command forces skip_checks=True unless the caller passed that option. Deployment-tagged checks such as check_secret_key are omitted unless include_deployment_checks is set. — [django/core/management/base.py#L446-471](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/management/base.py#L446-L471) [django/core/management/__init__.py#L191-194](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/management/__init__.py#L191-L194) [django/core/checks/registry.py#L74-94](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/checks/registry.py#L74-L94) [django/core/checks/security/base.py#L263-271](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/checks/security/base.py#L263-L271)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)