Django 中间件

MIDDLEWARE = [
# 安全中间件应该在最前面
'django.middleware.security.SecurityMiddleware',

# 会话支持
'django.contrib.sessions.middleware.SessionMiddleware',

# 通用中间件
'django.middleware.common.CommonMiddleware',

# CSRF 保护
'django.middleware.csrf.CsrfViewMiddleware',

# 用户认证
'django.contrib.auth.middleware.AuthenticationMiddleware',

# 消息框架
'django.contrib.messages.middleware.MessageMiddleware',

# 点击劫持保护 (旧版本)
# 'django.middleware.clickjacking.XFrameOptionsMiddleware',

# 自定义中间件
'myapp.middleware.CustomMiddleware',
]

# SecurityMiddleware 配置
SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_SSL_REDIRECT = False  # 生产环境设为 True
SECURE_HSTS_SECONDS = 31536000  # 1年
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True

# SessionMiddleware 配置
SESSION_ENGINE = 'django.contrib.sessions.backends.db'
SESSION_COOKIE_AGE = 1209600  # 2周，默认
SESSION_COOKIE_SECURE = True  # 仅HTTPS
SESSION_COOKIE_HTTPONLY = True

# CommonMiddleware 配置
APPEND_SLASH = True
PREPEND_WWW = False

from django.utils import timezone
from .models import UserActivity

class UserActivityMiddleware:
"""记录用户活动中间件"""

def __init__(self, get_response):
    self.get_response = get_response

def __call__(self, request):
    response = self.get_response(request)

    # 只记录认证用户的访问
    if request.user.is_authenticated:
        self.record_activity(request)

    return response

def record_activity(self, request):
    """记录用户活动"""
    try:
        UserActivity.objects.create(
            user=request.user,
            path=request.path,
            method=request.method,
            user_agent=request.META.get('HTTP_USER_AGENT', ''),
            ip_address=self.get_client_ip(request),
            timestamp=timezone.now()
        )
    except Exception as e:
        # 记录错误但不中断请求
        print(f"记录用户活动失败: {e}")

def get_client_ip(self, request):
    """获取客户端IP地址"""
    x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
    if x_forwarded_for:
        ip = x_forwarded_for.split(',')[0]
    else:
        ip = request.META.get('REMOTE_ADDR')
    return ip

class CorsMiddleware:
"""简单的 CORS 中间件"""

def __init__(self, get_response):
    self.get_response = get_response

def __call__(self, request):
    response = self.get_response(request)

    # 添加 CORS 头
    response['Access-Control-Allow-Origin'] = '*'
    response['Access-Control-Allow-Methods'] = 'GET, POST, PUT, DELETE, OPTIONS'
    response['Access-Control-Allow-Headers'] = 'Content-Type, Authorization'
    response['Access-Control-Allow-Credentials'] = 'true'

    return response

def process_view(self, request, view_func, view_args, view_kwargs):
    """处理 OPTIONS 预检请求"""
    if request.method == 'OPTIONS':
        response = HttpResponse()
        response['Access-Control-Allow-Origin'] = '*'
        response['Access-Control-Allow-Methods'] = 'GET, POST, PUT, DELETE, OPTIONS'
        response['Access-Control-Allow-Headers'] = 'Content-Type, Authorization'
        response['Access-Control-Allow-Credentials'] = 'true'
        return response

    return None

class IPRestrictionMiddleware:
"""IP地址限制中间件"""

def __init__(self, get_response):
    self.get_response = get_response

def __call__(self, request):
    client_ip = self.get_client_ip(request)

    # 检查IP是否在黑名单中
    if self.is_ip_blocked(client_ip):
        return HttpResponse(
            '您的IP地址已被限制访问',
            status=403
        )

    return self.get_response(request)

def get_client_ip(self, request):
    x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
    if x_forwarded_for:
        ip = x_forwarded_for.split(',')[0]
    else:
        ip = request.META.get('REMOTE_ADDR')
    return ip

def is_ip_blocked(self, ip):
    # 从数据库或设置中检查IP黑名单
    blocked_ips = getattr(settings, 'BLOCKED_IPS', [])
    return ip in blocked_ips

import logging
import json

logger = logging.getLogger('django.request')

class RequestLoggingMiddleware:
"""请求日志中间件"""

def __init__(self, get_response):
    self.get_response = get_response

def __call__(self, request):
    # 记录请求信息
    log_data = {
        'method': request.method,
        'path': request.path,
        'user_agent': request.META.get('HTTP_USER_AGENT', ''),
        'ip': self.get_client_ip(request),
        'user': str(request.user) if request.user.is_authenticated else 'anonymous'
    }

    logger.info(f"请求开始: {json.dumps(log_data)}")

    response = self.get_response(request)

    # 记录响应信息
    logger.info(f"请求完成: {request.method} {request.path} - {response.status_code}")

    return response

def get_client_ip(self, request):
    x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
    if x_forwarded_for:
        ip = x_forwarded_for.split(',')[0]
    else:
        ip = request.META.get('REMOTE_ADDR')
    return ip

def process_exception(self, request, exception):
    """记录异常"""
    logger.error(
        f"请求异常: {request.method} {request.path} - {str(exception)}",
        exc_info=True
    )