Django之session验证的三种姿势

Posted Crazy_lyl

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了Django之session验证的三种姿势相关的知识,希望对你有一定的参考价值。

一.什么是session

session是保存在服务端的键值对,Django默认支持Session,并且默认是将Session数据存储在数据库中,即:django_session 表中

二.FVB中使用装饰器进行session验证

认证装饰器:

# 登陆验证
def auth(func):
 \'\'\'判断是否登录装饰器\'\'\'
    def inner(request, *args, **kwargs):
        ck = request.session.get("username")
		\'\'\'如果没有登陆返回到login.html\'\'\'
        if not ck:
            return redirect("/login.html")
        return func(request, *args, **kwargs)
    return inner

 在需要认证的函数执行前加上装饰器认证即可,实际中应用如下:

def login(request):
    if request.method == "GET":
        return render(request, "login.html")
    else:
        username = request.POST.get("user")
        pwd = request.POST.get("pwd")
        pwd = md5(pwd)
        dic = {"flag":False}
        obj = User.objects.filter(username=username, pwd=pwd).first()
        if obj:
            request.session["username"] = username
            return redirect("/index.html")
        else:
            print(dic)
            return HttpResponse(json.dumps(dic))

@auth
def index(request):
    user = request.session.get("username")
    business = Business.objects.all().values("name")
    host_list = Host.objects.all().values("id","host","port","business__name")
    username = User.objects.all().values("username")
    return render(request, \'index.html\', {\'host_list\':host_list,"business":business,"user":user,"username":username})
	
@auth
def addhost(request):
    business = Business.objects.all().values("name")
    if request.method == "POST":
        user = request.session.get("username")
        host = request.POST.get("host")
        port = request.POST.get("port")
        select_business = request.POST.get("business")
        business_id = Business.objects.filter(name=select_business).values("id")[0]
        host = Host.objects.create(host=host,
                                  port=port,
                                  business_id=business_id["id"])
        # host.business.add(*business)
        return render(request, "index.html")

    return render(request, "index.html", {"business":business})
	
@auth
def up_business(request):
    if request.method == "POST":
        user = request.session.get("username")
        host= request.POST.get("host")
        port= request.POST.get("port")
        business_name = request.POST.get("business")
        username = request.POST.get("username")
        print(host,port,business_name,username)
        return render(request,"保存成功")

 三.CBV中使用类继承的方式进行session认证

  • cbv是 class based view(基于类)
  • cbv基于dispatch进行反射,get获取,post提交
  • 应用场景:登录认证(继承dispatch,在dispatch里做session验证)

CBV第一种方式继承

1.单继承

扫盲:(继承的时候,一定要清楚self是哪个类实例化出来的对象,下例,self为B实例化的对象,任何属性优先从自己里面找,找不到在去父类里找)

class A(object):
    def aaa(self):
        print(\'from A\')
    def bbb(self):
        self.aaa()
 
class B(A):
    def aaa(self):
        print(\'from B\')
 
c = B()
c.aaa()

应用:

from django.views import View
class BaseView(View):
    def dispatch(self, request, *args, **kwargs):  # 继承父类的dispatch,因为父类里有返回值,所以也要有return
        if request.session.get(\'username\'):
            response = super(BaseView, self).dispatch(request, *args, **kwargs)
            return response
        else:
            return redirect(\'/login.html\')
 
class IndexView(BaseView):
 
    def get(self, request, *args, **kwargs):
        return HttpResponse(request.session[\'username\'])

 2.多继承(继承顺序从左到右)

class BaseView(object):
    def dispatch(self, request, *args, **kwargs):
        if request.session.get(\'username\'):
            response = super(BaseView,self).dispatch(request, *args, **kwargs)
            return response
        else:
            return redirect(\'/login.html\')
 
class IndexView(BaseView,View):#先去找BaseView,BaseView中未定义在去找View
 
    def get(self,request,*args,**kwargs):
        return HttpResponse(request.session[\'username\'])

 CBV第二种方式装饰器

from django.utils.decorators import method_decorator
 
def auth(func): #定义装饰器
    def inner(request,*args,**kwargs):
        if request.session.get(\'username\'):
            obj = func(request,*args,**kwargs)
            return obj
        else:
            return redirect(\'/login.html\')
    return inner
 
@method_decorator(auth,name=\'get\')  #放在类顶部就需要method_decorator这个装饰器
class IndexView(View):
 
    @method_decorator(auth) #放在dispatch上就相当于全局都需要经过认证
    def dispatch(self, request, *args, **kwargs):
        if request.session.get(\'username\'):
            response = super(IndexView,self).dispatch(request, *args, **kwargs)
            return response
        else:
            return redirect(\'/login.html\')
 
    @method_decorator(auth)
    def get(self,request,*args,**kwargs):
        return HttpResponse(request.session[\'username\'])
 
    @method_decorator(csrf_exempt)  # 无效 csrf 放到post函数上的装饰器,是无效的,需要放到dispath上或者类上
    def post(self,request,*args,**kwargs):
        return HttpResponse(request.session[\'username\'])

 四.中间件middleware

如下是django的生命周期

 如下为中间件的执行顺序

 - 中间件执行时机:请求到来,请求返回时
  - 中间件是一个类:
  def process_request(self,request):
    print(\'m2.process_request\')

  def process_response(self,request, response):
    print(\'m2.prcess_response\')
    return response

    - 应用:
    - 请求日志
    - 用户登录认证

Django根目录新建md文件夹,新建Middleware.py文件

from django.utils.deprecation import MiddlewareMixin

class M1(MiddlewareMixin):
    \'\'\'先执行request,然后到url路由,url之后返回到最上方,在执行view,如果出现错误就直接到response上,执行完,到真正到视图,如果有问题就
    执行exception,从下至上查找,如果找到exception就直接执行exception的return在走response返回用户
    每个中间件中,4个方法不需要都写.
    \'\'\'
    def process_request(self,request):

        if request.path_info == "/login.html":
            return None
        user_info = request.session.get("username")
        if not user_info:
            return redirect("/login.html")

 注:新的django版本可能不存在MiddlewareMixin,需要手动写一下这个类进行继承

class MiddlewareMixin(object):
    def __init__(self, get_response=None):
        self.get_response = get_response
        super(MiddlewareMixin, self).__init__()

    def __call__(self, request):
        response = None
        if hasattr(self, \'process_request\'):
            response = self.process_request(request)
        if not response:
            response = self.get_response(request)
        if hasattr(self, \'process_response\'):
            response = self.process_response(request, response)
        return response

class M1(MiddlewareMixin):

    def process_request(self,request):

        if request.path_info == "/login.html":
            return None
        user_info = request.session.get("username")
        if not user_info:
            return redirect("/login.html")

 settings里配置:

MIDDLEWARE = [
    \'django.middleware.security.SecurityMiddleware\',
    \'django.contrib.sessions.middleware.SessionMiddleware\',
    \'django.middleware.common.CommonMiddleware\',
    \'django.middleware.csrf.CsrfViewMiddleware\',
    \'django.contrib.auth.middleware.AuthenticationMiddleware\',
    \'django.contrib.messages.middleware.MessageMiddleware\',
    \'django.middleware.clickjacking.XFrameOptionsMiddleware\',
    \'md.Middleware.M1\',
]

WSGI_APPLICATION = \'BBS.wsgi.application\'

SESSION_ENGINE = \'django.contrib.sessions.backends.db\'  # 引擎(默认)

SESSION_COOKIE_NAME = "sessionid"  # Session的cookie保存在浏览器上时的key,即:sessionid=随机字符串(默认)
SESSION_COOKIE_PATH = "/"  # Session的cookie保存的路径(默认)
SESSION_COOKIE_DOMAIN = None  # Session的cookie保存的域名(默认)
SESSION_COOKIE_SECURE = False  # 是否Https传输cookie(默认)
SESSION_COOKIE_HTTPONLY = True  # 是否Session的cookie只支持http传输(默认)
SESSION_COOKIE_AGE = 1209600  # Session的cookie失效日期(2周)(默认)
SESSION_EXPIRE_AT_BROWSER_CLOSE = False  # 是否关闭浏览器使得Session过期(默认)
SESSION_SAVE_EVERY_REQUEST = True  # 是否每次请求都保存Session,默认修改之后才保存(默认)

以上是关于Django之session验证的三种姿势的主要内容,如果未能解决你的问题,请参考以下文章

Spring Security---验证码详解

django-缓存的三种应用

HIbernate学习笔记3 之 缓存和 对象的三种状态

Java三大框架之——Hibernate中的三种数据持久状态和缓存机制

浅谈OC对象初始化的三种姿势

Spring中部署Activiti流程定义的三种姿势