Django's Test Client

What Django gives you. A TestCase that runs each test against a temporary database inside a transaction, rolled back afterwards, and a test client that makes requests without a server running.

So a test can create a post, request a page, and assert what came back, in a few lines and in a fraction of a second.

Test behavior, not implementation. A test asserting that a function returns a particular dictionary breaks every time you refactor. A test asserting that a draft is not visible to strangers keeps working, and is the one you actually care about.

The best tests read like the promises your application makes.

The tests worth writing first, in order:

That an unpublished post is not publicly visible.

That a stranger cannot edit someone else's post.

That a signed-out visitor is redirected rather than shown the form.

That the list page shows published posts and not drafts.

Every one of those is a security property. If they pass, the most damaging class of bug in this application cannot happen quietly.