1
class SessionMiddleware(MiddlewareMixin):
2
    # RemovedInDjango40Warning: when the deprecation ends, replace with:
3
    #   def __init__(self, get_response):
4
    def __init__(self, get_response=None):
5
        super().__init__(get_response)
6
        engine = import_module(settings.SESSION_ENGINE)
7
        self.SessionStore = engine.SessionStore
8

9
    def process_request(self, request):
10
        session_key = request.COOKIES.get(settings.SESSION_COOKIE_NAME)
11
        request.session = self.SessionStore(session_key)
12

13
    def process_response(self, request, response):
14
        """
15
        If request.session was modified, or if the configuration is to save the
16
        session every time, save the changes and set a session cookie or delete
17
        the session cookie if the session has been emptied.
18
        """
19
        try:
20
            accessed = request.session.accessed
21
            modified = request.session.modified
22
            empty = request.session.is_empty()
23
        except AttributeError:
24
            return response
25
        # First check if we need to delete this cookie.
26
        # The session should be deleted only if the session is entirely empty.
27
        if settings.SESSION_COOKIE_NAME in request.COOKIES and empty:
28
            response.delete_cookie(
29
                settings.SESSION_COOKIE_NAME,
30
                path=settings.SESSION_COOKIE_PATH,
31
                domain=settings.SESSION_COOKIE_DOMAIN,
32
                samesite=settings.SESSION_COOKIE_SAMESITE,
33
            )
34
            patch_vary_headers(response, ('Cookie',))
35
        else:
36
            if accessed:
37
                patch_vary_headers(response, ('Cookie',))
38
            if (modified or settings.SESSION_SAVE_EVERY_REQUEST) and not empty:
39
                if request.session.get_expire_at_browser_close():
40
                    max_age = None
41
                    expires = None
42
                else:
43
                    max_age = request.session.get_expiry_age()
44
                    expires_time = time.time() + max_age
45
                    expires = http_date(expires_time)
46
                # Save the session data and refresh the client cookie.
47
                # Skip session save for 500 responses, refs #3881.
48
                if response.status_code != 500:
49
                    try:
50
                        request.session.save()
51
                    except UpdateError:
52
                        raise SessionInterrupted(
53
                            "The request's session was deleted before the "
54
                            "request completed. The user may have logged "
55
                            "out in a concurrent request, for example."
56
                        )
57
                    response.set_cookie(
58
                        settings.SESSION_COOKIE_NAME,
59
                        request.session.session_key, max_age=max_age,
60
                        expires=expires, domain=settings.SESSION_COOKIE_DOMAIN,
61
                        path=settings.SESSION_COOKIE_PATH,
62
                        secure=settings.SESSION_COOKIE_SECURE or None,
63
                        httponly=settings.SESSION_COOKIE_HTTPONLY or None,
64
                        samesite=settings.SESSION_COOKIE_SAMESITE,
65
                    )
66
        return response

1
class CsrfViewMiddleware(MiddlewareMixin):
2
    """
3
    Require a present and correct csrfmiddlewaretoken for POST requests that
4
    have a CSRF cookie, and set an outgoing CSRF cookie.
5

6
    This middleware should be used in conjunction with the {% csrf_token %}
7
    template tag.
8
    """
9
    # The _accept and _reject methods currently only exist for the sake of the
10
    # requires_csrf_token decorator.
11
    def _accept(self, request):
12
        # Avoid checking the request twice by adding a custom attribute to
13
        # request.  This will be relevant when both decorator and middleware
14
        # are used.
15
        request.csrf_processing_done = True
16
        return None
17

18
    def _reject(self, request, reason):
19
        response = _get_failure_view()(request, reason=reason)
20
        log_response(
21
            'Forbidden (%s): %s', reason, request.path,
22
            response=response,
23
            request=request,
24
            logger=logger,
25
        )
26
        return response
27

28
    def _get_token(self, request):
29
        if settings.CSRF_USE_SESSIONS:
30
            try:
31
                return request.session.get(CSRF_SESSION_KEY)
32
            except AttributeError:
33
                raise ImproperlyConfigured(
34
                    'CSRF_USE_SESSIONS is enabled, but request.session is not '
35
                    'set. SessionMiddleware must appear before CsrfViewMiddleware '
36
                    'in MIDDLEWARE.'
37
                )
38
        else:
39
            try:
40
                cookie_token = request.COOKIES[settings.CSRF_COOKIE_NAME]
41
            except KeyError:
42
                return None
43

44
            csrf_token = _sanitize_token(cookie_token)
45
            if csrf_token != cookie_token:
46
                # Cookie token needed to be replaced;
47
                # the cookie needs to be reset.
48
                request.csrf_cookie_needs_reset = True
49
            return csrf_token
50

51
    def _set_token(self, request, response):
52
        if settings.CSRF_USE_SESSIONS:
53
            if request.session.get(CSRF_SESSION_KEY) != request.META['CSRF_COOKIE']:
54
                request.session[CSRF_SESSION_KEY] = request.META['CSRF_COOKIE']
55
        else:
56
            response.set_cookie(
57
                settings.CSRF_COOKIE_NAME,
58
                request.META['CSRF_COOKIE'],
59
                max_age=settings.CSRF_COOKIE_AGE,
60
                domain=settings.CSRF_COOKIE_DOMAIN,
61
                path=settings.CSRF_COOKIE_PATH,
62
                secure=settings.CSRF_COOKIE_SECURE,
63
                httponly=settings.CSRF_COOKIE_HTTPONLY,
64
                samesite=settings.CSRF_COOKIE_SAMESITE,
65
            )
66
            # Set the Vary header since content varies with the CSRF cookie.
67
            patch_vary_headers(response, ('Cookie',))
68

69
    def process_request(self, request):
70
        csrf_token = self._get_token(request)
71
        if csrf_token is not None:
72
            # Use same token next time.
73
            request.META['CSRF_COOKIE'] = csrf_token
74

75
    def process_view(self, request, callback, callback_args, callback_kwargs):
76
        if getattr(request, 'csrf_processing_done', False):
77
            return None
78

79
        # Wait until request.META["CSRF_COOKIE"] has been manipulated before
80
        # bailing out, so that get_token still works
81
        if getattr(callback, 'csrf_exempt', False):
82
            return None
83

84
        # Assume that anything not defined as 'safe' by RFC7231 needs protection
85
        if request.method not in ('GET', 'HEAD', 'OPTIONS', 'TRACE'):
86
            if getattr(request, '_dont_enforce_csrf_checks', False):
87
                # Mechanism to turn off CSRF checks for test suite.
88
                # It comes after the creation of CSRF cookies, so that
89
                # everything else continues to work exactly the same
90
                # (e.g. cookies are sent, etc.), but before any
91
                # branches that call reject().
92
                return self._accept(request)
93

94
            if request.is_secure():
95
                # Suppose user visits http://example.com/
96
                # An active network attacker (man-in-the-middle, MITM) sends a
97
                # POST form that targets https://example.com/detonate-bomb/ and
98
                # submits it via JavaScript.
99
                #
100
                # The attacker will need to provide a CSRF cookie and token, but
101
                # that's no problem for a MITM and the session-independent
102
                # secret we're using. So the MITM can circumvent the CSRF
103
                # protection. This is true for any HTTP connection, but anyone
104
                # using HTTPS expects better! For this reason, for
105
                # https://example.com/ we need additional protection that treats
106
                # http://example.com/ as completely untrusted. Under HTTPS,
107
                # Barth et al. found that the Referer header is missing for
108
                # same-domain requests in only about 0.2% of cases or less, so
109
                # we can use strict Referer checking.
110
                referer = request.META.get('HTTP_REFERER')
111
                if referer is None:
112
                    return self._reject(request, REASON_NO_REFERER)
113

114
                referer = urlparse(referer)
115

116
                # Make sure we have a valid URL for Referer.
117
                if '' in (referer.scheme, referer.netloc):
118
                    return self._reject(request, REASON_MALFORMED_REFERER)
119

120
                # Ensure that our Referer is also secure.
121
                if referer.scheme != 'https':
122
                    return self._reject(request, REASON_INSECURE_REFERER)
123

124
                # If there isn't a CSRF_COOKIE_DOMAIN, require an exact match
125
                # match on host:port. If not, obey the cookie rules (or those
126
                # for the session cookie, if CSRF_USE_SESSIONS).
127
                good_referer = (
128
                    settings.SESSION_COOKIE_DOMAIN
129
                    if settings.CSRF_USE_SESSIONS
130
                    else settings.CSRF_COOKIE_DOMAIN
131
                )
132
                if good_referer is not None:
133
                    server_port = request.get_port()
134
                    if server_port not in ('443', '80'):
135
                        good_referer = '%s:%s' % (good_referer, server_port)
136
                else:
137
                    try:
138
                        # request.get_host() includes the port.
139
                        good_referer = request.get_host()
140
                    except DisallowedHost:
141
                        pass
142

143
                # Create a list of all acceptable HTTP referers, including the
144
                # current host if it's permitted by ALLOWED_HOSTS.
145
                good_hosts = list(settings.CSRF_TRUSTED_ORIGINS)
146
                if good_referer is not None:
147
                    good_hosts.append(good_referer)
148

149
                if not any(is_same_domain(referer.netloc, host) for host in good_hosts):
150
                    reason = REASON_BAD_REFERER % referer.geturl()
151
                    return self._reject(request, reason)
152

153
            # Access csrf_token via self._get_token() as rotate_token() may
154
            # have been called by an authentication middleware during the
155
            # process_request() phase.
156
            csrf_token = self._get_token(request)
157
            if csrf_token is None:
158
                # No CSRF cookie. For POST requests, we insist on a CSRF cookie,
159
                # and in this way we can avoid all CSRF attacks, including login
160
                # CSRF.
161
                return self._reject(request, REASON_NO_CSRF_COOKIE)
162

163
            # Check non-cookie token for match.
164
            request_csrf_token = ""
165
            if request.method == "POST":
166
                try:
167
                    request_csrf_token = request.POST.get('csrfmiddlewaretoken', '')
168
                except OSError:
169
                    # Handle a broken connection before we've completed reading
170
                    # the POST data. process_view shouldn't raise any
171
                    # exceptions, so we'll ignore and serve the user a 403
172
                    # (assuming they're still listening, which they probably
173
                    # aren't because of the error).
174
                    pass
175

176
            if request_csrf_token == "":
177
                # Fall back to X-CSRFToken, to make things easier for AJAX,
178
                # and possible for PUT/DELETE.
179
                request_csrf_token = request.META.get(settings.CSRF_HEADER_NAME, '')
180

181
            request_csrf_token = _sanitize_token(request_csrf_token)
182
            if not _compare_masked_tokens(request_csrf_token, csrf_token):
183
                return self._reject(request, REASON_BAD_TOKEN)
184

185
        return self._accept(request)
186

187
    def process_response(self, request, response):
188
        if not getattr(request, 'csrf_cookie_needs_reset', False):
189
            if getattr(response, 'csrf_cookie_set', False):
190
                return response
191

192
        if not request.META.get("CSRF_COOKIE_USED", False):
193
            return response
194

195
        # Set the CSRF cookie even if it's already set, so we renew
196
        # the expiry timer.
197
        self._set_token(request, response)
198
        response.csrf_cookie_set = True
199
        return response

1
class CsrfViewMiddleware(MiddlewareMixin):
2

3
    # requires_csrf_token decorator.
4
    def _accept(self, request):
5

6
        request.csrf_processing_done = True
7
        return None
8

9
    def _reject(self, request, reason):
10

11
        return response
12

13
    def _get_token(self, request):
14

15
            return csrf_token
16

17
    def _set_token(self, request, response):
18

19

20
    def process_request(self, request):
21
        csrf_token = self._get_token(request)
22
        if csrf_token is not None:
23
            # Use same token next time.
24
            request.META['CSRF_COOKIE'] = csrf_token
25

26
    def process_view(self, request, callback, callback_args, callback_kwargs):
27

28

29
        return self._accept(request)
30

31
    def process_response(self, request, response):
32
        if not getattr(request, 'csrf_cookie_needs_reset', False):
33
            if getattr(response, 'csrf_cookie_set', False):
34
                return response
35

36
        if not request.META.get("CSRF_COOKIE_USED", False):
37
            return response
38
        self._set_token(request, response)
39
        response.csrf_cookie_set = True
40
        return response

1
# -*-coding: Utf-8 -*-
2
# @File : my_middle .py
3
# author: Chimengmeng
4
# blog_url : https://www.cnblogs.com/dream-ze/
5
# Time：2023/7/17
6

7
# 引入父类
8
from django.utils.deprecation import MiddlewareMixin
9

10

11
class MyMiddle(MiddlewareMixin):
12
    def process_request(self, request):
13
        print("这是第一个自定义中间件中的 process_request 方法")
14

15
class MyMiddle2(MiddlewareMixin):
16
    def process_request(self, request):
17
        print("这是第二个自定义中间件中的 process_request 方法")