如何防止 Django Rest 中的暴力攻击 + 使用 Django Rest Throttling

Posted 2023-02-24

【中文标题】如何防止 Django Rest 中的暴力攻击 + 使用 Django Rest Throttling

【英文标题】：How to prevent brute force attack in Django Rest + Using Django Rest Throttling

【发布时间】：2018-09-30 20:15:23

【问题描述】：

在特定时间阻止特定用户使用 Django REST Throttling。

我见过Django REST Throttling。

我不想使用第三方包。

提前致谢

【参考方案1】：

我在自定义Django REST Throttling后找到了解决方案，

在 3 次登录尝试后阻止特定用户（阻止我的应用程序中出现的 user_id）。 匿名用户 6 次登录尝试后阻止 IP 地址。

prevent.py:-

#!/usr/bin/python

from collections import Counter

from rest_framework.throttling import SimpleRateThrottle
from django.contrib.auth.models import User


class UserLoginRateThrottle(SimpleRateThrottle):
    scope = 'loginAttempts'

    def get_cache_key(self, request, view):
        user = User.objects.filter(username=request.data.get('username'))
        ident = user[0].pk if user else self.get_ident(request)

        return self.cache_format % 
            'scope': self.scope,
            'ident': ident
        

    def allow_request(self, request, view):
        """
        Implement the check to see if the request should be throttled.
        On success calls `throttle_success`.
        On failure calls `throttle_failure`.
        """
        if self.rate is None:
            return True

        self.key = self.get_cache_key(request, view)
        if self.key is None:
            return True

        self.history = self.cache.get(self.key, [])
        self.now = self.timer()

        while self.history and self.history[-1] <= self.now - self.duration:
            self.history.pop()

        if len(self.history) >= self.num_requests:
            return self.throttle_failure()

        if len(self.history) >= 3:
            data = Counter(self.history)
            for key, value in data.items():
                if value == 2:
                    return self.throttle_failure()
        return self.throttle_success(request)

    def throttle_success(self, request):
        """
        Inserts the current request's timestamp along with the key
        into the cache.
        """
        user = User.objects.filter(username=request.data.get('username'))
        if user:
            self.history.insert(0, user[0].id)
        self.history.insert(0, self.now)
        self.cache.set(self.key, self.history, self.duration)
        return True

view.py：-

  from .prevent import UserLoginRateThrottle
   ....
   ....
   ....
   class ObtainAuthToken(auth_views.ObtainAuthToken):
       throttle_classes = (UserLoginRateThrottle,)/use this method here your login view

       def post(self, request, *args, **kwargs):
           ....
       ....

在设置文件中添加一些参数

settings.py：-

# Django-rest-framework
REST_FRAMEWORK = 
    ...
    ...
    ...
    'DEFAULT_THROTTLE_CLASSES': (
        'rest_framework.throttling.UserRateThrottle',

    ),
    'DEFAULT_THROTTLE_RATES': 
        'loginAttempts': '6/hr',
        'user': '1000/min',