Architecture and Security Design of a Dual-Service Iot Telemetry and Ecommerce Platform: A Flask–Django Case Study with JWT Authentication and Layered Test Automation

This paper documents the architecture, security design, and database evolution of a two-tier system built to support an environmental-telemetry and micro-desalination business scenario, comprising a Flask REST API for Internet of Things (IoT) buoy telemetry ingestion and a Django eCommerce platform for product sales and subscription management. We describe the system’s modular separation of concerns (a stateless, JWT-secured ingestion API decoupled from a session-oriented commerce platform), the specific security controls applied at each layer (JWT-based stateless authentication for the API; Django’s built-in Cross-Site Request Forgery and SQL-injection middleware for the platform), and the database migration from SQLite to MySQL undertaken specifically in response to a measured concurrency limitation under bulk telemetry ingestion. We report the integration mechanism connecting the two otherwise loosely coupled services (token-based cross-service authentication and shared schema conventions) and the specific coordination overhead this integration introduced. We position the architecture against established microservice design literature and REST architectural-style principles, and we provide a candid account of which design decisions are well supported by that literature and which represent pragmatic compromises specific to a timeand resource-constrained development context, together with the concrete changes (CI/CD pipeline integration, containerisation, formal load testing) that would be required before the architecture could be considered production-ready rather than a validated prototype.

Software architecture, REST API design, JWT authentication, microservices, Flask, Django, database migration, IoT telemetry systems

1. R. T. Fielding, “Architectural styles and the design of network-based software architectures,” Ph.D. dissertation, University of California, Irvine, 2000. [Google Scholar] [Crossref]

2. S. Newman, Building Microservices: Designing Fine-Grained Systems. Sebastopol, CA: O’Reilly Media, 2015. [Google Scholar] [Crossref]

3. M. Jones, J. Bradley, and N. Sakimura, “RFC 7519: JSON web token (JWT),” Internet Engineering Task Force (IETF), 2015. [Google Scholar] [Crossref]

4. Django Software Foundation, “Django security documentation: Cross site request forgery protection,” https://docs.djangoproject.com/en/stable/ref/ csrf/, 2024. [Google Scholar] [Crossref]

5. OWASP Foundation, “OWASP top ten 2021,” https://owasp.org/Top10/, 2021. [Google Scholar] [Crossref]

6. M. Stonebraker, “SQL databases v. NoSQL databases,” Communications of the ACM, vol. 53, no. 4, pp. 10–11, 2010. [Google Scholar] [Crossref]

7. M. Fawzy, A. Tahir, M. Galster et al., “Exploring data management challenges and solutions in agile software development: A literature review and practitioner survey,” Empirical Software Engineering, vol. 30, p. 106, 2025. [Google Scholar] [Crossref]

8. OpenAPI Initiative, “OpenAPI specification v3.1.0,” https://spec. openapis.org/oas/v3.1.0, 2021. [Google Scholar] [Crossref]

9. M. Widenius and D. Axmark, MySQL Reference Manual. Sebastopol, CA: O’Reilly Media, 2002. [Google Scholar] [Crossref]