Cookie登錄驗證
def check_login(func): @wraps(func) def inner(request, *args, **kwargs): next_url = request.get_full_path() if request.get_signed_cookie("login", salt="SSS", default=None) == "yes": # 已經登錄的用戶... return func(request, *args, **kwargs) else: # 沒有登錄的用戶，跳轉剛到登錄頁面 return redirect("/login/?next={}".format(next_url)) return inner def login(request): if request.method == "POST": username = request.POST.get("username") passwd = request.POST.get("password") if username == "xxx" and passwd == "dashabi": next_url = request.GET.get("next") if next_url and next_url != "/logout/": response = redirect(next_url) else: response = redirect("/class_list/") response.set_signed_cookie("login", "yes", salt="SSS") return response return render(request, "login.html")
Session版登陸驗證
Session版登陸驗證 from functools import wraps def check_login(func): @wraps(func) def inner(request, *args, **kwargs): next_url = request.get_full_path() if request.session.get("user"): return func(request, *args, **kwargs) else: return redirect("/login/?next={}".format(next_url)) return inner def login(request): if request.method == "POST": user = request.POST.get("user") pwd = request.POST.get("pwd") if user == "alex" and pwd == "alex1234": # 設置session request.session["user"] = user # 獲取跳到登陸頁面之前的URL next_url = request.GET.get("next") # 如果有，就跳轉回登陸之前的URL if next_url: return redirect(next_url) # 否則默認跳轉到index頁面 else: return redirect("/index/") return render(request, "login.html") @check_login def logout(request): # 刪除所有當前請求相關的session request.session.delete() return redirect("/login/") @check_login def index(request): current_user = request.session.get("user", None) return render(request, "index.html", {"user": current_user})
中間件版登錄驗證
中間件版的登錄驗證需要依靠session，所以數據庫中要有django_session表。
urls.py
from django.conf.urls import url from app01 import views urlpatterns = [ url(r'^index/$', views.index), url(r'^login/$', views.login, name='login'), ]
views.py
from django.shortcuts import render, HttpResponse, redirect def index(request): return HttpResponse('this is index') def home(request): return HttpResponse('this is home') def login(request): if request.method == "POST": user = request.POST.get("user") pwd = request.POST.get("pwd") if user == "Q1mi" and pwd == "123456": # 設置session request.session["user"] = user # 獲取跳到登陸頁面之前的URL next_url = request.GET.get("next") # 如果有，就跳轉回登陸之前的URL if next_url: return redirect(next_url) # 否則默認跳轉到index頁面 else: return redirect("/index/") return render(request, "login.html")
login.html
<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="x-ua-compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>登錄頁面</title> </head> <body> <form action="{% url 'login' %}"> <p> <label for="user">用戶名：</label> <input type="text" name="user" id="user"> </p> <p> <label for="pwd">密 碼：</label> <input type="text" name="pwd" id="pwd"> </p> <input type="submit" value="登錄"> </form> </body> </html>
middlewares.py
class AuthMD(MiddlewareMixin): white_list = ['/login/', ] # 白名單 balck_list = ['/black/', ] # 黑名單 def process_request(self, request): from django.shortcuts import redirect, HttpResponse next_url = request.path_info print(request.path_info, request.get_full_path()) if next_url in self.white_list or request.session.get("user"): return elif next_url in self.balck_list: return HttpResponse('This is an illegal URL') else: return redirect("/login/?next={}".format(next_url))
在settings.py中注冊
MIDDLEWARE = [ 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'middlewares.AuthMD', ]
AuthMD中間件注冊后，所有的請求都要走AuthMD的process_request方法。
訪問的URL在白名單內或者session中有user用戶名，則不做阻攔走正常流程；
如果URL在黑名單中，則返回This is an illegal URL的字符串；
正常的URL但是需要登錄后訪問，讓瀏覽器跳轉到登錄頁面。
注：AuthMD中間件中需要session，所以AuthMD注冊的位置要在session中間的下方。