Drf05 / homologous cross-domain, DRF throttle (source code analysis)

1. Cross-Domain

由于浏览器具有“同源策略”的限制。
如果在同一个域下发送ajax请求，浏览器的同源策略不会阻止。
如果在不同域下发送ajax，浏览器的同源策略会阻止。

to sum up

The same domain, will never exist across domains.
- CRM, the front and rear ends of the non-separated, there is no cross-domain.
- Luffy Xuecheng, around the end of the separation, there is no cross-domain (there before, not now).
Domain is not the same, only the presence of cross-domain.
- l pull hook net, separated front and rear ends, cross-domain (the first solution is provided in response to cross-domain)

To solve cross-domain: CORS

本质在数据返回值设置响应头

from django.shortcuts import render,HttpResponse

def json(request):
    response = HttpResponse("JSONasdfasdf")
    response['Access-Control-Allow-Origin'] = "*"
    return response

When cross-domain, a request is sent twice?

When cross-domain request will be divided into two types:

A simple request, send a request.

设置响应头就可以解决
from django.shortcuts import render,HttpResponse

def json(request):
    response = HttpResponse("JSONasdfasdf")
    response['Access-Control-Allow-Origin'] = "*"
    return response

Complex requests, send requests.

Preflight
request

@csrf_exempt
def put_json(request):
    response = HttpResponse("JSON复杂请求")
    if request.method == 'OPTIONS':
        # 处理预检
        response['Access-Control-Allow-Origin'] = "*"
        response['Access-Control-Allow-Methods'] = "PUT"
        return response
    elif request.method == "PUT":
        return response

  条件：
  1、请求方式：HEAD、GET、POST
  2、请求头信息：
      Accept
      Accept-Language
      Content-Language
      Last-Event-ID
      Content-Type 对应的值是以下三个中的任意一个
                              application/x-www-form-urlencoded
                              multipart/form-data
                              text/plain

    注意：同时满足以上两个条件时，则是简单请求，否则为复杂请求

to sum up

Due to browser limitations have "same origin policy", so cross-domain Ajax requests on the browser, the browser will be blocked.
To solve cross-domain
- No cross-domain
- CORS (cross-site sharing of resources, nature is set up in response to solve).
  - A simple request: a request sending
  - Complex requests: sending two requests

2.drf access frequency limit

Frequency limit after authentication, permissions

Knowledge Point

{
  throttle_anon_1.1.1.1:[100121340,],
  1.1.1.2:[100121251,100120450,]
}


限制：60s能访问3次
来访问时：
  1.获取当前时间 100121280
  2.100121280-60 = 100121220，小于100121220所有记录删除
  3.判断1分钟以内已经访问多少次了？ 4 
  4.无法访问
停一会
来访问时：
  1.获取当前时间 100121340
  2.100121340-60 = 100121280,小于100121280所有记录删除
  3.判断1分钟以内已经访问多少次了？ 0
  4.可以访问

Source

from rest_framework.views import APIView
from rest_framework.response import Response

from rest_framework.throttling import AnonRateThrottle,BaseThrottle

class ArticleView(APIView):
    throttle_classes = [AnonRateThrottle,]
    def get(self,request,*args,**kwargs):
        return Response('文章列表')

class ArticleDetailView(APIView):
    def get(self,request,*args,**kwargs):
        return Response('文章列表')

class BaseThrottle:
    """
    Rate throttling of requests.
    """

    def allow_request(self, request, view):
        """
        Return `True` if the request should be allowed, `False` otherwise.
        """
        raise NotImplementedError('.allow_request() must be overridden')

    def get_ident(self, request):
        """
        Identify the machine making the request by parsing HTTP_X_FORWARDED_FOR
        if present and number of proxies is > 0. If not use all of
        HTTP_X_FORWARDED_FOR if it is available, if not use REMOTE_ADDR.
        """
        xff = request.META.get('HTTP_X_FORWARDED_FOR')
        remote_addr = request.META.get('REMOTE_ADDR')
        num_proxies = api_settings.NUM_PROXIES

        if num_proxies is not None:
            if num_proxies == 0 or xff is None:
                return remote_addr
            addrs = xff.split(',')
            client_addr = addrs[-min(num_proxies, len(addrs))]
            return client_addr.strip()

        return ''.join(xff.split()) if xff else remote_addr

    def wait(self):
        """
        Optionally, return a recommended number of seconds to wait before
        the next request.
        """
        return None


class SimpleRateThrottle(BaseThrottle):
    """
    A simple cache implementation, that only requires `.get_cache_key()`
    to be overridden.

    The rate (requests / seconds) is set by a `rate` attribute on the View
    class.  The attribute is a string of the form 'number_of_requests/period'.

    Period should be one of: ('s', 'sec', 'm', 'min', 'h', 'hour', 'd', 'day')

    Previous request information used for throttling is stored in the cache.
    """
    cache = default_cache
    timer = time.time
    cache_format = 'throttle_%(scope)s_%(ident)s'
    scope = None
    THROTTLE_RATES = api_settings.DEFAULT_THROTTLE_RATES

    def __init__(self):
        if not getattr(self, 'rate', None):
            self.rate = self.get_rate()
        self.num_requests, self.duration = self.parse_rate(self.rate)

    def get_cache_key(self, request, view):
        """
        Should return a unique cache-key which can be used for throttling.
        Must be overridden.

        May return `None` if the request should not be throttled.
        """
        raise NotImplementedError('.get_cache_key() must be overridden')

    def get_rate(self):
        """
        Determine the string representation of the allowed request rate.
        """
        if not getattr(self, 'scope', None):
            msg = ("You must set either `.scope` or `.rate` for '%s' throttle" %
                   self.__class__.__name__)
            raise ImproperlyConfigured(msg)

        try:
            return self.THROTTLE_RATES[self.scope]
        except KeyError:
            msg = "No default throttle rate set for '%s' scope" % self.scope
            raise ImproperlyConfigured(msg)

    def parse_rate(self, rate):
        """
        Given the request rate string, return a two tuple of:
        <allowed number of requests>, <period of time in seconds>
        """
        if rate is None:
            return (None, None)
        num, period = rate.split('/')
        num_requests = int(num)
        duration = {'s': 1, 'm': 60, 'h': 3600, 'd': 86400}[period[0]]
        return (num_requests, duration)

    def allow_request(self, request, view):  --- 1
        """
        Implement the check to see if the request should be throttled.

        On success calls `throttle_success`.
        On failure calls `throttle_failure`.
        """
        if self.rate is None:  
            return True

        # 获取请求用户的IP
        self.key = self.get_cache_key(request, view)
        if self.key is None:
            return True

        # 根据IP获取他的所有访问记录，[]
        self.history = self.cache.get(self.key, [])

        self.now = self.timer()

        # Drop any requests from the history which have now passed the
        # throttle duration
        while self.history and self.history[-1] <= self.now - self.duration:
            self.history.pop()
        if len(self.history) >= self.num_requests:
            return self.throttle_failure()
        return self.throttle_success()

    def throttle_success(self):
        """
        Inserts the current request's timestamp along with the key
        into the cache.
        """
        self.history.insert(0, self.now)
        self.cache.set(self.key, self.history, self.duration)
        return True

    def throttle_failure(self):
        """
        Called when a request to the API has failed due to throttling.
        """
        return False

    def wait(self):
        """
        Returns the recommended next request time in seconds.
        """
        if self.history:
            remaining_duration = self.duration - (self.now - self.history[-1])
        else:
            remaining_duration = self.duration

        available_requests = self.num_requests - len(self.history) + 1
        if available_requests <= 0:
            return None

        return remaining_duration / float(available_requests)


class AnonRateThrottle(SimpleRateThrottle):
    """
    Limits the rate of API calls that may be made by a anonymous users.

    The IP address of the request will be used as the unique cache key.
    """
    scope = 'anon'

    def get_cache_key(self, request, view):
        if request.user.is_authenticated:
            return None  # Only throttle unauthenticated requests.

        return self.cache_format % {
            'scope': self.scope,
            'ident': self.get_ident(request)
        }

1、请求来时，先执行allow_request方法

to sum up

How to limit the rate of assessment

- 匿名用户，用IP作为用户唯一标记，但如果用户换代理IP，无法做到真正的限制。
- 登录用户，用用户名或用户ID做标识。
具体实现：
 在django的缓存中 = {
        throttle_anon_1.1.1.1:[100121340,],
        1.1.1.2:[100121251,100120450,]
    }


    限制：60s能访问3次
    来访问时：
        1.获取当前时间 100121280
        2.100121280-60 = 100121220，小于100121220所有记录删除
        3.判断1分钟以内已经访问多少次了？ 4 
        4.无法访问
    停一会
    来访问时：
        1.获取当前时间 100121340
        2.100121340-60 = 100121280,小于100121280所有记录删除
        3.判断1分钟以内已经访问多少次了？ 0
        4.可以访问

请求来时会执行allow_follow方法，
会用self.key获取请求用户的ip，再用self.history根据用户的ip获取其访问的记录，
获取当前的时间，用当前的时间减去设定的时间段，
循环该用户访问的记录，将不在该时间段的记录pop掉，
通过len判定该时间段已经访问了多少次，超过限定次数会返回false

4.jwt

用于在前后端分离时，实现用户登录相关。

User authentication in general there are 2 ways:

token

用户登录成功之后，生成一个随机字符串，自己保留一分+给前端返回一份。

以后前端再来发请求时，需要携带字符串。
后端对字符串进行校验。

jwt

用户登录成功之后，生成一个随机字符串，给前端。
  - 生成随机字符串
      {typ:"jwt","alg":'HS256'}     {id:1,username:'alx','exp':10}
      98qow39df0lj980945lkdjflo.saueoja8979284sdfsdf.asiuokjd978928374
      - 类型信息通过base64加密
      - 数据通过base64加密
      - 两个密文拼接在h256加密+加盐
  - 给前端返回
      98qow39df0lj980945lkdjflo.saueoja8979284sdfsdf.asiuokjd978928375

前端获取随机字符串之后，保留起来。
以后再来发送请求时，携带98qow39df0lj980945lkdjflo.saueoja8979284sdfsdf.asiuokjd978928375。


后端接受到之后，
  1.先做时间判断
    2.字符串合法性校验。

用户登录成功后，会生成一个随机字符串，两点分成三段，第一段是类型以及加密的算法经过base64加密，第二段是数据通过base64加密，第三段是前两段拼接起来惊醒hs256加密后，再进行base64加密，最后给前段返回这个随机字符串

installation

pip3 install djangorestframework-jwt

Case

app registered

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'api.apps.ApiConfig',
    'rest_framework',
    'rest_framework_jwt'
]

User login

import uuid
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework.versioning import URLPathVersioning
from rest_framework import status

from api import models

class LoginView(APIView):
    """
    登录接口
    """
    def post(self,request,*args,**kwargs):

        # 基于jwt的认证
        # 1.去数据库获取用户信息
        from rest_framework_jwt.settings import api_settings
        jwt_payload_handler = api_settings.JWT_PAYLOAD_HANDLER
        jwt_encode_handler = api_settings.JWT_ENCODE_HANDLER

        user = models.UserInfo.objects.filter(**request.data).first()
        if not user:
            return Response({'code':1000,'error':'用户名或密码错误'})

        payload = jwt_payload_handler(user)
        token = jwt_encode_handler(payload)
        return Response({'code':1001,'data':token})

User Authentication

from rest_framework.views import APIView
from rest_framework.response import Response

# from rest_framework.throttling import AnonRateThrottle,BaseThrottle


class ArticleView(APIView):
    # throttle_classes = [AnonRateThrottle,]

    def get(self,request,*args,**kwargs):
        # 获取用户提交的token，进行一步一步校验
        import jwt
        from rest_framework import exceptions
        from rest_framework_jwt.settings import api_settings
        jwt_decode_handler = api_settings.JWT_DECODE_HANDLER

        jwt_value = request.query_params.get('token')
        try:
            payload = jwt_decode_handler(jwt_value)
        except jwt.ExpiredSignature:
            msg = '签名已过期'
            raise exceptions.AuthenticationFailed(msg)
        except jwt.DecodeError:
            msg = '认证失败'
            raise exceptions.AuthenticationFailed(msg)
        except jwt.InvalidTokenError:
            raise exceptions.AuthenticationFailed()
        print(payload)

        return Response('文章列表')

Drf05 / homologous cross-domain, DRF throttle (source code analysis)

Drf05 / homologous cross-domain, DRF throttle (source code analysis)

1. Cross-Domain

to sum up

To solve cross-domain: CORS

When cross-domain, a request is sent twice?

to sum up

2.drf access frequency limit

Source

to sum up

4.jwt

installation

Case

Guess you like