blocks|key|1203708|text|使用中间件。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1203709|http://www.djangobook.com/en/2.0/chapter17/和http://docs.djangoproject.com/en/1.2/topics/http/middleware/#topics-http-middleware|offset|length|1203710|我假设这在1.2中没有太大的改变|1203711|中间件允许您创建一个具有方法的类，这些方法将按照您的定义在不同的时间/条件下处理每个请求。|1203712|例如，process_request(request)将在您的视图之前触发，此时您可以强制执行身份验证和授权。|1203713|entityMap|0|LINK|mutability|MUTABLE|url|http://www.djangobook.com/en/2.0/chapter17/|1|http://docs.djangoproject.com/en/1.2/topics/http/middleware/#topics-http-middleware^0|0|0|17|0|18|2B|1|0|0|0|0^^$0|@$1|2|3|4|5|6|7|V|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|W|8|@]|9|@$D|X|E|Y|1|Z]|$D|10|E|11|1|12]]|A|$]]|$1|F|3|G|5|6|7|13|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|14|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|15|8|@]|9|@]|A|$]]|$1|L|3|-4|5|6|7|16|8|@]|9|@]|A|$]]]|M|$N|$5|O|P|Q|A|$R|S]]|T|$5|O|P|Q|A|$R|U]]]]

Use middleware.

<a href="http://www.djangobook.com/en/2.0/chapter17/" rel="nofollow noreferrer">http://www.djangobook.com/en/2.0/chapter17/</a>
and
<a href="http://docs.djangoproject.com/en/1.2/topics/http/middleware/#topics-http-middleware" rel="nofollow noreferrer">http://docs.djangoproject.com/en/1.2/topics/http/middleware/#topics-http-middleware</a>

I'm assuming this didn't change a whole lot in 1.2

Middleware allows you to create a class with methods who will process every request at various times/conditions, as you define.

for example process_request(request) would fire before your view, and you can force authentication and authorization at this point.

blocks|key|989333|text|把它放到我的项目根目录下的middleware.py文件中(取自http://onecreativeblog.com/post/59051248/django-login-required-middleware)|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|989334|from+django.http+import+HttpResponseRedirect
from+django.conf+import+settings
from+re+import+compile

EXEMPT_URLS+=+[compile(settings.LOGIN_URL.lstrip('/'))]
if+hasattr(settings,+'LOGIN_EXEMPT_URLS'):
++++EXEMPT_URLS+%2B=+[compile(expr)+for+expr+in+settings.LOGIN_EXEMPT_URLS]

class+LoginRequiredMiddleware:
++++"""
++++Middleware+that+requires+a+user+to+be+authenticated+to+view+any+page+other
++++than+LOGIN_URL.+Exemptions+to+this+requirement+can+optionally+be+specified
++++in+settings+via+a+list+of+regular+expressions+in+LOGIN_EXEMPT_URLS+(which
++++you+can+copy+from+your+urls.py).

++++Requires+authentication+middleware+and+template+context+processors+to+be
++++loaded.+You'll+get+an+error+if+they+aren't.
++++"""
++++def+process_request(self,+request):
++++++++assert+hasattr(request,+'user'),+"The+Login+Required+middleware\
+requires+authentication+middleware+to+be+installed.+Edit+your\
+MIDDLEWARE_CLASSES+setting+to+insert\
+'django.contrib.auth.middlware.AuthenticationMiddleware'.+If+that+doesn't\
+work,+ensure+your+TEMPLATE_CONTEXT_PROCESSORS+setting+includes\
+'django.core.context_processors.auth'."
++++++++if+not+request.user.is_authenticated():
++++++++++++path+=+request.path_info.lstrip('/')
++++++++++++if+not+any(m.match(path)+for+m+in+EXEMPT_URLS):
++++++++++++++++return+HttpResponseRedirect(settings.LOGIN_URL)|code-block|syntax|javascript|989335|然后在settings.py中将projectname.middleware.LoginRequiredMiddleware附加到我的MIDDLEWARE_CLASSES。|989336|entityMap|0|LINK|mutability|MUTABLE|url|http://onecreativeblog.com/post/59051248/django-login-required-middleware^0|D|D|W|21|0|0|0|G|1A|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]]|D|@$9|X|A|Y|1|Z]]|E|$]]|$1|F|3|G|5|H|7|10|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|11|8|@$9|12|A|13|B|C]]|D|@]|E|$]]|$1|M|3|-4|5|6|7|14|8|@]|D|@]|E|$]]]|N|$O|$5|P|Q|R|E|$S|T]]]]

Dropped this into a <code>middleware.py</code> file in my project root (taken from <a href="http://onecreativeblog.com/post/59051248/django-login-required-middleware" rel="noreferrer">http://onecreativeblog.com/post/59051248/django-login-required-middleware</a>)

<pre><code>from django.http import HttpResponseRedirect
from django.conf import settings
from re import compile

EXEMPT_URLS = [compile(settings.LOGIN_URL.lstrip('/'))]
if hasattr(settings, 'LOGIN_EXEMPT_URLS'):
 EXEMPT_URLS += [compile(expr) for expr in settings.LOGIN_EXEMPT_URLS]

class LoginRequiredMiddleware:
 """
 Middleware that requires a user to be authenticated to view any page other
 than LOGIN_URL. Exemptions to this requirement can optionally be specified
 in settings via a list of regular expressions in LOGIN_EXEMPT_URLS (which
 you can copy from your urls.py).

 Requires authentication middleware and template context processors to be
 loaded. You'll get an error if they aren't.
 """
 def process_request(self, request):
 assert hasattr(request, 'user'), "The Login Required middleware\
 requires authentication middleware to be installed. Edit your\
 MIDDLEWARE_CLASSES setting to insert\
 'django.contrib.auth.middlware.AuthenticationMiddleware'. If that doesn't\
 work, ensure your TEMPLATE_CONTEXT_PROCESSORS setting includes\
 'django.core.context_processors.auth'."
 if not request.user.is_authenticated():
 path = request.path_info.lstrip('/')
 if not any(m.match(path) for m in EXEMPT_URLS):
 return HttpResponseRedirect(settings.LOGIN_URL)
</code></pre>

Then appended <code>projectname.middleware.LoginRequiredMiddleware</code> to my MIDDLEWARE_CLASSES in settings.py.

blocks|key|989419|text|对于那些后来了解这一点的人，你可能会发现django-stronghold非常适合你的用例。您将所有想要公开的urls列入白名单，其余的都需要登录。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|989420|https://github.com/mgrouchy/django-stronghold|offset|length|989421|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|19|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@$D|O|E|P|1|Q]]|A|$]]|$1|F|3|-4|5|6|7|R|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|C]]]]

For those who have come by later to this, you might find that django-stronghold fits your usecase well. You whitelist any urls you want to be public, the rest are login required. 

<a href="https://github.com/mgrouchy/django-stronghold">https://github.com/mgrouchy/django-stronghold</a>

blocks|key|989577|text|这里有一个稍微短一些的中间件。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|989578|from+django.contrib.auth.decorators+import+login_required

class+LoginRequiredMiddleware(object):
++++def+process_view(self,+request,+view_func,+view_args,+view_kwargs):
++++++++if+not+getattr(view_func,+'login_required',+True):
++++++++++++return+None
++++++++return+login_required(view_func)(request,+*view_args,+**view_kwargs)|code-block|syntax|javascript|989579|在不需要登录即可查看的每个视图上，您必须将"login_required“设置为False：|989580|函数-视图：|989581|def+someview(request,+*args,+**kwargs):
++++#+body+of+view
someview.login_required+=+False|989582|基于类的视图：|989583|class+SomeView(View):
++++login_required+=+False
++++#+body+of+view

#or

class+SomeView(View):
++++#+body+of+view
someview+=+SomeView.as_view()
someview.login_required+=+False|989584|这意味着您必须对登录视图做一些处理，但无论如何，我总是要编写自己的auth-backend。|989585|entityMap^0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|W|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|X|8|@]|9|@]|A|$]]|$1|K|3|L|5|D|7|Y|8|@]|9|@]|A|$E|F]]|$1|M|3|N|5|6|7|Z|8|@]|9|@]|A|$]]|$1|O|3|P|5|D|7|10|8|@]|9|@]|A|$E|F]]|$1|Q|3|R|5|6|7|11|8|@]|9|@]|A|$]]|$1|S|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|T|$]]

Here's a slightly shorter middleware. 

<pre><code>from django.contrib.auth.decorators import login_required

class LoginRequiredMiddleware(object):
 def process_view(self, request, view_func, view_args, view_kwargs):
 if not getattr(view_func, 'login_required', True):
 return None
 return login_required(view_func)(request, *view_args, **view_kwargs)
</code></pre>

You'll have to set "login_required" to False on each view you don't need to be logged in to see:

Function-views:

<pre><code>def someview(request, *args, **kwargs):
 # body of view
someview.login_required = False
</code></pre>

Class-based views:

<pre><code>class SomeView(View):
 login_required = False
 # body of view

#or

class SomeView(View):
 # body of view
someview = SomeView.as_view()
someview.login_required = False
</code></pre>

This means you'll have to do something about the login-views, but I always end up writing my own auth-backend anyway.

blocks|key|989646|text|以下是Django+1.10%2B中的新型中间件示例：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|989647|from+django.contrib.auth.decorators+import+login_required
from+django.urls+import+reverse

def+login_required_middleware(get_response):
++++"""
++++++++Require+user+to+be+logged+in+for+all+views.+
++++"""
++++exceptions+=+{'/admin/login/'}
++++def+middleware(request):
++++++++if+request.path+in+exceptions:
++++++++++++return+get_response(request)
++++++++return+login_required(get_response,+login_url=reverse('admin:login'))(request)
++++return+middleware|code-block|syntax|javascript|989648|此示例免除管理员登录表单以避免重定向循环，并使用该表单作为登录url。|989649|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Here's an example for new-style middleware in Django 1.10+:

<pre><code>from django.contrib.auth.decorators import login_required
from django.urls import reverse

def login_required_middleware(get_response):
 """
 Require user to be logged in for all views. 
 """
 exceptions = {'/admin/login/'}
 def middleware(request):
 if request.path in exceptions:
 return get_response(request)
 return login_required(get_response, login_url=reverse('admin:login'))(request)
 return middleware
</code></pre>

This example exempts the admin login form to avoid redirect loop, and uses that form as the login url.

blocks|key|1204173|text|之前的一些答案要么过时了(Django的旧版本)，要么引入了糟糕的编程实践(硬编码URL，不使用路由)。这是我的观点，更枯燥和可持续/可维护(改编自Mehmet's+answer+above)。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1204174|为了突出这里的改进，这依赖于为URL提供路由名称(这比使用硬编码的URL/URI更可靠，因为这些URL/URI会发生变化，并具有尾随/前导斜杠)。|1204175|from+django.utils.deprecation+import+MiddlewareMixin
from+django.urls+import+resolve,+reverse
from+django.http+import+HttpResponseRedirect
from+my_project+import+settings

class+LoginRequiredMiddleware(MiddlewareMixin):
++++"""
++++Middleware+that+requires+a+user+to+be+authenticated+to+view+any+page+other
++++than+LOGIN_URL.+Exemptions+to+this+requirement+can+optionally+be+specified
++++in+settings+by+setting+a+tuple+of+routes+to+ignore
++++"""
++++def+process_request(self,+request):
++++++++assert+hasattr(request,+'user'),+"""
++++++++The+Login+Required+middleware+needs+to+be+after+AuthenticationMiddleware.
++++++++Also+make+sure+to+include+the+template+context_processor:
++++++++'django.contrib.auth.context_processors.auth'."""

++++++++if+not+request.user.is_authenticated:
++++++++++++current_route_name+=+resolve(request.path_info).url_name

++++++++++++if+not+current_route_name+in+settings.AUTH_EXEMPT_ROUTES:
++++++++++++++++return+HttpResponseRedirect(reverse(settings.AUTH_LOGIN_ROUTE))|code-block|syntax|javascript|1204176|在settings.py文件中，您可以定义以下内容：|style|CODE|1204177|AUTH_EXEMPT_ROUTES+=+('register',+'login',+'forgot-password')
AUTH_LOGIN_ROUTE+=+'register'|1204178|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/a/49683283/366529^0|22|L|0|0|0|0|1|B|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@$A|Z|B|10|1|11]]|C|$]]|$1|D|3|E|5|6|7|12|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|13|8|@]|9|@]|C|$I|J]]|$1|K|3|L|5|6|7|14|8|@$A|15|B|16|M|N]]|9|@]|C|$]]|$1|O|3|P|5|H|7|17|8|@]|9|@]|C|$I|J]]|$1|Q|3|-4|5|6|7|18|8|@]|9|@]|C|$]]]|R|$S|$5|T|U|V|C|$W|X]]]]

Some of the previous answers are either outdated (older version of Django), or introduce poor programming practices (hardcoding URLs, not using routes). Here's my take that is more DRY and sustainable/maintainable (adapted from <a href="https://stackoverflow.com/a/49683283/366529">Mehmet's answer above</a>).

To highlight the improvements here, this relies on giving URLs route names (which are much more reliable than using hard-coded URLs/URIs that change and have trailing/leading slashes).

<pre><code>from django.utils.deprecation import MiddlewareMixin
from django.urls import resolve, reverse
from django.http import HttpResponseRedirect
from my_project import settings

class LoginRequiredMiddleware(MiddlewareMixin):
 """
 Middleware that requires a user to be authenticated to view any page other
 than LOGIN_URL. Exemptions to this requirement can optionally be specified
 in settings by setting a tuple of routes to ignore
 """
 def process_request(self, request):
 assert hasattr(request, 'user'), """
 The Login Required middleware needs to be after AuthenticationMiddleware.
 Also make sure to include the template context_processor:
 'django.contrib.auth.context_processors.auth'."""

 if not request.user.is_authenticated:
 current_route_name = resolve(request.path_info).url_name

 if not current_route_name in settings.AUTH_EXEMPT_ROUTES:
 return HttpResponseRedirect(reverse(settings.AUTH_LOGIN_ROUTE))
</code></pre>

And in the <code>settings.py</code> file, you can define the following:

<pre><code>AUTH_EXEMPT_ROUTES = ('register', 'login', 'forgot-password')
AUTH_LOGIN_ROUTE = 'register'
</code></pre>

The <a href="http://docs.djangoproject.com/en/dev/topics/auth/#the-login-required-decorator" rel="noreferrer">example</a> provides a snippet for an application level view, but what if I have lots of different (and some non-application) entries in my "urls.py" file, including templates? How can I apply this login_required decorator to each of them?

<pre><code>(r'^foo/(?P&lt;slug&gt;[-\w]+)/$', 'bugs.views.bug_detail'),
(r'^$', 'django.views.generic.simple.direct_to_template', {'template':'homepage.html'}),
</code></pre>

Django: How can I apply the login_required decorator to my entire site (excluding static media)?

为应用程序级别的视图提供了一个片段，但是如果我的"urls.py“文件中有许多不同的(和一些非应用程序的)条目，包括模板，该怎么办？我如何将这个login_required装饰器应用到它们中的每一个呢？(r'^foo/(?P<slug>[-\w]+)/$', 'bugs.views.bug_detail'),(r'^$...

问Django:我如何将login_required装饰器应用于我的整个站点(静态媒体除外)？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Django:我如何将login_required装饰器应用于我的整个站点(静态媒体除外)？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Django:我如何将login_required装饰器应用于我的整个站点(静态媒体除外)？
EN