docker setup
This commit is contained in:
AdrienLSH
@ -0,0 +1,211 @@
|
||||
"""
|
||||
Cache middleware. If enabled, each Django-powered page will be cached based on
|
||||
URL. The canonical way to enable cache middleware is to set
|
||||
``UpdateCacheMiddleware`` as your first piece of middleware, and
|
||||
``FetchFromCacheMiddleware`` as the last::
|
||||
|
||||
MIDDLEWARE = [
|
||||
'django.middleware.cache.UpdateCacheMiddleware',
|
||||
...
|
||||
'django.middleware.cache.FetchFromCacheMiddleware'
|
||||
]
|
||||
|
||||
This is counter-intuitive, but correct: ``UpdateCacheMiddleware`` needs to run
|
||||
last during the response phase, which processes middleware bottom-up;
|
||||
``FetchFromCacheMiddleware`` needs to run last during the request phase, which
|
||||
processes middleware top-down.
|
||||
|
||||
The single-class ``CacheMiddleware`` can be used for some simple sites.
|
||||
However, if any other piece of middleware needs to affect the cache key, you'll
|
||||
need to use the two-part ``UpdateCacheMiddleware`` and
|
||||
``FetchFromCacheMiddleware``. This'll most often happen when you're using
|
||||
Django's ``LocaleMiddleware``.
|
||||
|
||||
More details about how the caching works:
|
||||
|
||||
* Only GET or HEAD-requests with status code 200 are cached.
|
||||
|
||||
* The number of seconds each page is stored for is set by the "max-age" section
|
||||
of the response's "Cache-Control" header, falling back to the
|
||||
CACHE_MIDDLEWARE_SECONDS setting if the section was not found.
|
||||
|
||||
* This middleware expects that a HEAD request is answered with the same response
|
||||
headers exactly like the corresponding GET request.
|
||||
|
||||
* When a hit occurs, a shallow copy of the original response object is returned
|
||||
from process_request.
|
||||
|
||||
* Pages will be cached based on the contents of the request headers listed in
|
||||
the response's "Vary" header.
|
||||
|
||||
* This middleware also sets ETag, Last-Modified, Expires and Cache-Control
|
||||
headers on the response object.
|
||||
|
||||
"""
|
||||
|
||||
from django.conf import settings
|
||||
from django.core.cache import DEFAULT_CACHE_ALIAS, caches
|
||||
from django.utils.cache import (
|
||||
get_cache_key,
|
||||
get_max_age,
|
||||
has_vary_header,
|
||||
learn_cache_key,
|
||||
patch_response_headers,
|
||||
)
|
||||
from django.utils.deprecation import MiddlewareMixin
|
||||
|
||||
|
||||
class UpdateCacheMiddleware(MiddlewareMixin):
|
||||
"""
|
||||
Response-phase cache middleware that updates the cache if the response is
|
||||
cacheable.
|
||||
|
||||
Must be used as part of the two-part update/fetch cache middleware.
|
||||
UpdateCacheMiddleware must be the first piece of middleware in MIDDLEWARE
|
||||
so that it'll get called last during the response phase.
|
||||
"""
|
||||
|
||||
def __init__(self, get_response):
|
||||
super().__init__(get_response)
|
||||
self.cache_timeout = settings.CACHE_MIDDLEWARE_SECONDS
|
||||
self.page_timeout = None
|
||||
self.key_prefix = settings.CACHE_MIDDLEWARE_KEY_PREFIX
|
||||
self.cache_alias = settings.CACHE_MIDDLEWARE_ALIAS
|
||||
|
||||
@property
|
||||
def cache(self):
|
||||
return caches[self.cache_alias]
|
||||
|
||||
def _should_update_cache(self, request, response):
|
||||
return hasattr(request, "_cache_update_cache") and request._cache_update_cache
|
||||
|
||||
def process_response(self, request, response):
|
||||
"""Set the cache, if needed."""
|
||||
if not self._should_update_cache(request, response):
|
||||
# We don't need to update the cache, just return.
|
||||
return response
|
||||
|
||||
if response.streaming or response.status_code not in (200, 304):
|
||||
return response
|
||||
|
||||
# Don't cache responses that set a user-specific (and maybe security
|
||||
# sensitive) cookie in response to a cookie-less request.
|
||||
if (
|
||||
not request.COOKIES
|
||||
and response.cookies
|
||||
and has_vary_header(response, "Cookie")
|
||||
):
|
||||
return response
|
||||
|
||||
# Don't cache a response with 'Cache-Control: private'
|
||||
if "private" in response.get("Cache-Control", ()):
|
||||
return response
|
||||
|
||||
# Page timeout takes precedence over the "max-age" and the default
|
||||
# cache timeout.
|
||||
timeout = self.page_timeout
|
||||
if timeout is None:
|
||||
# The timeout from the "max-age" section of the "Cache-Control"
|
||||
# header takes precedence over the default cache timeout.
|
||||
timeout = get_max_age(response)
|
||||
if timeout is None:
|
||||
timeout = self.cache_timeout
|
||||
elif timeout == 0:
|
||||
# max-age was set to 0, don't cache.
|
||||
return response
|
||||
patch_response_headers(response, timeout)
|
||||
if timeout and response.status_code == 200:
|
||||
cache_key = learn_cache_key(
|
||||
request, response, timeout, self.key_prefix, cache=self.cache
|
||||
)
|
||||
if hasattr(response, "render") and callable(response.render):
|
||||
response.add_post_render_callback(
|
||||
lambda r: self.cache.set(cache_key, r, timeout)
|
||||
)
|
||||
else:
|
||||
self.cache.set(cache_key, response, timeout)
|
||||
return response
|
||||
|
||||
|
||||
class FetchFromCacheMiddleware(MiddlewareMixin):
|
||||
"""
|
||||
Request-phase cache middleware that fetches a page from the cache.
|
||||
|
||||
Must be used as part of the two-part update/fetch cache middleware.
|
||||
FetchFromCacheMiddleware must be the last piece of middleware in MIDDLEWARE
|
||||
so that it'll get called last during the request phase.
|
||||
"""
|
||||
|
||||
def __init__(self, get_response):
|
||||
super().__init__(get_response)
|
||||
self.key_prefix = settings.CACHE_MIDDLEWARE_KEY_PREFIX
|
||||
self.cache_alias = settings.CACHE_MIDDLEWARE_ALIAS
|
||||
|
||||
@property
|
||||
def cache(self):
|
||||
return caches[self.cache_alias]
|
||||
|
||||
def process_request(self, request):
|
||||
"""
|
||||
Check whether the page is already cached and return the cached
|
||||
version if available.
|
||||
"""
|
||||
if request.method not in ("GET", "HEAD"):
|
||||
request._cache_update_cache = False
|
||||
return None # Don't bother checking the cache.
|
||||
|
||||
# try and get the cached GET response
|
||||
cache_key = get_cache_key(request, self.key_prefix, "GET", cache=self.cache)
|
||||
if cache_key is None:
|
||||
request._cache_update_cache = True
|
||||
return None # No cache information available, need to rebuild.
|
||||
response = self.cache.get(cache_key)
|
||||
# if it wasn't found and we are looking for a HEAD, try looking just for that
|
||||
if response is None and request.method == "HEAD":
|
||||
cache_key = get_cache_key(
|
||||
request, self.key_prefix, "HEAD", cache=self.cache
|
||||
)
|
||||
response = self.cache.get(cache_key)
|
||||
|
||||
if response is None:
|
||||
request._cache_update_cache = True
|
||||
return None # No cache information available, need to rebuild.
|
||||
|
||||
# hit, return cached response
|
||||
request._cache_update_cache = False
|
||||
return response
|
||||
|
||||
|
||||
class CacheMiddleware(UpdateCacheMiddleware, FetchFromCacheMiddleware):
|
||||
"""
|
||||
Cache middleware that provides basic behavior for many simple sites.
|
||||
|
||||
Also used as the hook point for the cache decorator, which is generated
|
||||
using the decorator-from-middleware utility.
|
||||
"""
|
||||
|
||||
def __init__(self, get_response, cache_timeout=None, page_timeout=None, **kwargs):
|
||||
super().__init__(get_response)
|
||||
# We need to differentiate between "provided, but using default value",
|
||||
# and "not provided". If the value is provided using a default, then
|
||||
# we fall back to system defaults. If it is not provided at all,
|
||||
# we need to use middleware defaults.
|
||||
|
||||
try:
|
||||
key_prefix = kwargs["key_prefix"]
|
||||
if key_prefix is None:
|
||||
key_prefix = ""
|
||||
self.key_prefix = key_prefix
|
||||
except KeyError:
|
||||
pass
|
||||
try:
|
||||
cache_alias = kwargs["cache_alias"]
|
||||
if cache_alias is None:
|
||||
cache_alias = DEFAULT_CACHE_ALIAS
|
||||
self.cache_alias = cache_alias
|
||||
except KeyError:
|
||||
pass
|
||||
|
||||
if cache_timeout is not None:
|
||||
self.cache_timeout = cache_timeout
|
||||
self.page_timeout = page_timeout
|
||||
@ -0,0 +1,48 @@
|
||||
"""
|
||||
Clickjacking Protection Middleware.
|
||||
|
||||
This module provides a middleware that implements protection against a
|
||||
malicious site loading resources from your site in a hidden frame.
|
||||
"""
|
||||
|
||||
from django.conf import settings
|
||||
from django.utils.deprecation import MiddlewareMixin
|
||||
|
||||
|
||||
class XFrameOptionsMiddleware(MiddlewareMixin):
|
||||
"""
|
||||
Set the X-Frame-Options HTTP header in HTTP responses.
|
||||
|
||||
Do not set the header if it's already set or if the response contains
|
||||
a xframe_options_exempt value set to True.
|
||||
|
||||
By default, set the X-Frame-Options header to 'DENY', meaning the response
|
||||
cannot be displayed in a frame, regardless of the site attempting to do so.
|
||||
To enable the response to be loaded on a frame within the same site, set
|
||||
X_FRAME_OPTIONS in your project's Django settings to 'SAMEORIGIN'.
|
||||
"""
|
||||
|
||||
def process_response(self, request, response):
|
||||
# Don't set it if it's already in the response
|
||||
if response.get("X-Frame-Options") is not None:
|
||||
return response
|
||||
|
||||
# Don't set it if they used @xframe_options_exempt
|
||||
if getattr(response, "xframe_options_exempt", False):
|
||||
return response
|
||||
|
||||
response.headers["X-Frame-Options"] = self.get_xframe_options_value(
|
||||
request,
|
||||
response,
|
||||
)
|
||||
return response
|
||||
|
||||
def get_xframe_options_value(self, request, response):
|
||||
"""
|
||||
Get the value to set for the X_FRAME_OPTIONS header. Use the value from
|
||||
the X_FRAME_OPTIONS setting, or 'DENY' if not set.
|
||||
|
||||
This method can be overridden if needed, allowing it to vary based on
|
||||
the request or response.
|
||||
"""
|
||||
return getattr(settings, "X_FRAME_OPTIONS", "DENY").upper()
|
||||
@ -0,0 +1,178 @@
|
||||
import re
|
||||
from urllib.parse import urlparse
|
||||
|
||||
from django.conf import settings
|
||||
from django.core.exceptions import PermissionDenied
|
||||
from django.core.mail import mail_managers
|
||||
from django.http import HttpResponsePermanentRedirect
|
||||
from django.urls import is_valid_path
|
||||
from django.utils.deprecation import MiddlewareMixin
|
||||
from django.utils.http import escape_leading_slashes
|
||||
|
||||
|
||||
class CommonMiddleware(MiddlewareMixin):
|
||||
"""
|
||||
"Common" middleware for taking care of some basic operations:
|
||||
|
||||
- Forbid access to User-Agents in settings.DISALLOWED_USER_AGENTS
|
||||
|
||||
- URL rewriting: Based on the APPEND_SLASH and PREPEND_WWW settings,
|
||||
append missing slashes and/or prepends missing "www."s.
|
||||
|
||||
- If APPEND_SLASH is set and the initial URL doesn't end with a
|
||||
slash, and it is not found in urlpatterns, form a new URL by
|
||||
appending a slash at the end. If this new URL is found in
|
||||
urlpatterns, return an HTTP redirect to this new URL; otherwise
|
||||
process the initial URL as usual.
|
||||
|
||||
This behavior can be customized by subclassing CommonMiddleware and
|
||||
overriding the response_redirect_class attribute.
|
||||
"""
|
||||
|
||||
response_redirect_class = HttpResponsePermanentRedirect
|
||||
|
||||
def process_request(self, request):
|
||||
"""
|
||||
Check for denied User-Agents and rewrite the URL based on
|
||||
settings.APPEND_SLASH and settings.PREPEND_WWW
|
||||
"""
|
||||
|
||||
# Check for denied User-Agents
|
||||
user_agent = request.META.get("HTTP_USER_AGENT")
|
||||
if user_agent is not None:
|
||||
for user_agent_regex in settings.DISALLOWED_USER_AGENTS:
|
||||
if user_agent_regex.search(user_agent):
|
||||
raise PermissionDenied("Forbidden user agent")
|
||||
|
||||
# Check for a redirect based on settings.PREPEND_WWW
|
||||
host = request.get_host()
|
||||
|
||||
if settings.PREPEND_WWW and host and not host.startswith("www."):
|
||||
# Check if we also need to append a slash so we can do it all
|
||||
# with a single redirect. (This check may be somewhat expensive,
|
||||
# so we only do it if we already know we're sending a redirect,
|
||||
# or in process_response if we get a 404.)
|
||||
if self.should_redirect_with_slash(request):
|
||||
path = self.get_full_path_with_slash(request)
|
||||
else:
|
||||
path = request.get_full_path()
|
||||
|
||||
return self.response_redirect_class(f"{request.scheme}://www.{host}{path}")
|
||||
|
||||
def should_redirect_with_slash(self, request):
|
||||
"""
|
||||
Return True if settings.APPEND_SLASH is True and appending a slash to
|
||||
the request path turns an invalid path into a valid one.
|
||||
"""
|
||||
if settings.APPEND_SLASH and not request.path_info.endswith("/"):
|
||||
urlconf = getattr(request, "urlconf", None)
|
||||
if not is_valid_path(request.path_info, urlconf):
|
||||
match = is_valid_path("%s/" % request.path_info, urlconf)
|
||||
if match:
|
||||
view = match.func
|
||||
return getattr(view, "should_append_slash", True)
|
||||
return False
|
||||
|
||||
def get_full_path_with_slash(self, request):
|
||||
"""
|
||||
Return the full path of the request with a trailing slash appended.
|
||||
|
||||
Raise a RuntimeError if settings.DEBUG is True and request.method is
|
||||
POST, PUT, or PATCH.
|
||||
"""
|
||||
new_path = request.get_full_path(force_append_slash=True)
|
||||
# Prevent construction of scheme relative urls.
|
||||
new_path = escape_leading_slashes(new_path)
|
||||
if settings.DEBUG and request.method in ("POST", "PUT", "PATCH"):
|
||||
raise RuntimeError(
|
||||
"You called this URL via %(method)s, but the URL doesn't end "
|
||||
"in a slash and you have APPEND_SLASH set. Django can't "
|
||||
"redirect to the slash URL while maintaining %(method)s data. "
|
||||
"Change your form to point to %(url)s (note the trailing "
|
||||
"slash), or set APPEND_SLASH=False in your Django settings."
|
||||
% {
|
||||
"method": request.method,
|
||||
"url": request.get_host() + new_path,
|
||||
}
|
||||
)
|
||||
return new_path
|
||||
|
||||
def process_response(self, request, response):
|
||||
"""
|
||||
When the status code of the response is 404, it may redirect to a path
|
||||
with an appended slash if should_redirect_with_slash() returns True.
|
||||
"""
|
||||
# If the given URL is "Not Found", then check if we should redirect to
|
||||
# a path with a slash appended.
|
||||
if response.status_code == 404 and self.should_redirect_with_slash(request):
|
||||
return self.response_redirect_class(self.get_full_path_with_slash(request))
|
||||
|
||||
# Add the Content-Length header to non-streaming responses if not
|
||||
# already set.
|
||||
if not response.streaming and not response.has_header("Content-Length"):
|
||||
response.headers["Content-Length"] = str(len(response.content))
|
||||
|
||||
return response
|
||||
|
||||
|
||||
class BrokenLinkEmailsMiddleware(MiddlewareMixin):
|
||||
def process_response(self, request, response):
|
||||
"""Send broken link emails for relevant 404 NOT FOUND responses."""
|
||||
if response.status_code == 404 and not settings.DEBUG:
|
||||
domain = request.get_host()
|
||||
path = request.get_full_path()
|
||||
referer = request.META.get("HTTP_REFERER", "")
|
||||
|
||||
if not self.is_ignorable_request(request, path, domain, referer):
|
||||
ua = request.META.get("HTTP_USER_AGENT", "<none>")
|
||||
ip = request.META.get("REMOTE_ADDR", "<none>")
|
||||
mail_managers(
|
||||
"Broken %slink on %s"
|
||||
% (
|
||||
(
|
||||
"INTERNAL "
|
||||
if self.is_internal_request(domain, referer)
|
||||
else ""
|
||||
),
|
||||
domain,
|
||||
),
|
||||
"Referrer: %s\nRequested URL: %s\nUser agent: %s\n"
|
||||
"IP address: %s\n" % (referer, path, ua, ip),
|
||||
fail_silently=True,
|
||||
)
|
||||
return response
|
||||
|
||||
def is_internal_request(self, domain, referer):
|
||||
"""
|
||||
Return True if the referring URL is the same domain as the current
|
||||
request.
|
||||
"""
|
||||
# Different subdomains are treated as different domains.
|
||||
return bool(re.match("^https?://%s/" % re.escape(domain), referer))
|
||||
|
||||
def is_ignorable_request(self, request, uri, domain, referer):
|
||||
"""
|
||||
Return True if the given request *shouldn't* notify the site managers
|
||||
according to project settings or in situations outlined by the inline
|
||||
comments.
|
||||
"""
|
||||
# The referer is empty.
|
||||
if not referer:
|
||||
return True
|
||||
|
||||
# APPEND_SLASH is enabled and the referer is equal to the current URL
|
||||
# without a trailing slash indicating an internal redirect.
|
||||
if settings.APPEND_SLASH and uri.endswith("/") and referer == uri[:-1]:
|
||||
return True
|
||||
|
||||
# A '?' in referer is identified as a search engine source.
|
||||
if not self.is_internal_request(domain, referer) and "?" in referer:
|
||||
return True
|
||||
|
||||
# The referer is equal to the current URL, ignoring the scheme (assumed
|
||||
# to be a poorly implemented bot).
|
||||
parsed_referer = urlparse(referer)
|
||||
if parsed_referer.netloc in ["", domain] and parsed_referer.path == uri:
|
||||
return True
|
||||
|
||||
return any(pattern.search(uri) for pattern in settings.IGNORABLE_404_URLS)
|
||||
@ -0,0 +1,488 @@
|
||||
"""
|
||||
Cross Site Request Forgery Middleware.
|
||||
|
||||
This module provides a middleware that implements protection
|
||||
against request forgeries from other sites.
|
||||
"""
|
||||
import logging
|
||||
import string
|
||||
from collections import defaultdict
|
||||
from urllib.parse import urlparse
|
||||
|
||||
from django.conf import settings
|
||||
from django.core.exceptions import DisallowedHost, ImproperlyConfigured
|
||||
from django.http import HttpHeaders, UnreadablePostError
|
||||
from django.urls import get_callable
|
||||
from django.utils.cache import patch_vary_headers
|
||||
from django.utils.crypto import constant_time_compare, get_random_string
|
||||
from django.utils.deprecation import MiddlewareMixin
|
||||
from django.utils.functional import cached_property
|
||||
from django.utils.http import is_same_domain
|
||||
from django.utils.log import log_response
|
||||
from django.utils.regex_helper import _lazy_re_compile
|
||||
|
||||
logger = logging.getLogger("django.security.csrf")
|
||||
# This matches if any character is not in CSRF_ALLOWED_CHARS.
|
||||
invalid_token_chars_re = _lazy_re_compile("[^a-zA-Z0-9]")
|
||||
|
||||
REASON_BAD_ORIGIN = "Origin checking failed - %s does not match any trusted origins."
|
||||
REASON_NO_REFERER = "Referer checking failed - no Referer."
|
||||
REASON_BAD_REFERER = "Referer checking failed - %s does not match any trusted origins."
|
||||
REASON_NO_CSRF_COOKIE = "CSRF cookie not set."
|
||||
REASON_CSRF_TOKEN_MISSING = "CSRF token missing."
|
||||
REASON_MALFORMED_REFERER = "Referer checking failed - Referer is malformed."
|
||||
REASON_INSECURE_REFERER = (
|
||||
"Referer checking failed - Referer is insecure while host is secure."
|
||||
)
|
||||
# The reason strings below are for passing to InvalidTokenFormat. They are
|
||||
# phrases without a subject because they can be in reference to either the CSRF
|
||||
# cookie or non-cookie token.
|
||||
REASON_INCORRECT_LENGTH = "has incorrect length"
|
||||
REASON_INVALID_CHARACTERS = "has invalid characters"
|
||||
|
||||
CSRF_SECRET_LENGTH = 32
|
||||
CSRF_TOKEN_LENGTH = 2 * CSRF_SECRET_LENGTH
|
||||
CSRF_ALLOWED_CHARS = string.ascii_letters + string.digits
|
||||
CSRF_SESSION_KEY = "_csrftoken"
|
||||
|
||||
|
||||
def _get_failure_view():
|
||||
"""Return the view to be used for CSRF rejections."""
|
||||
return get_callable(settings.CSRF_FAILURE_VIEW)
|
||||
|
||||
|
||||
def _get_new_csrf_string():
|
||||
return get_random_string(CSRF_SECRET_LENGTH, allowed_chars=CSRF_ALLOWED_CHARS)
|
||||
|
||||
|
||||
def _mask_cipher_secret(secret):
|
||||
"""
|
||||
Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a
|
||||
token by adding a mask and applying it to the secret.
|
||||
"""
|
||||
mask = _get_new_csrf_string()
|
||||
chars = CSRF_ALLOWED_CHARS
|
||||
pairs = zip((chars.index(x) for x in secret), (chars.index(x) for x in mask))
|
||||
cipher = "".join(chars[(x + y) % len(chars)] for x, y in pairs)
|
||||
return mask + cipher
|
||||
|
||||
|
||||
def _unmask_cipher_token(token):
|
||||
"""
|
||||
Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length
|
||||
CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt
|
||||
the second half to produce the original secret.
|
||||
"""
|
||||
mask = token[:CSRF_SECRET_LENGTH]
|
||||
token = token[CSRF_SECRET_LENGTH:]
|
||||
chars = CSRF_ALLOWED_CHARS
|
||||
pairs = zip((chars.index(x) for x in token), (chars.index(x) for x in mask))
|
||||
return "".join(chars[x - y] for x, y in pairs) # Note negative values are ok
|
||||
|
||||
|
||||
def _add_new_csrf_cookie(request):
|
||||
"""Generate a new random CSRF_COOKIE value, and add it to request.META."""
|
||||
csrf_secret = _get_new_csrf_string()
|
||||
request.META.update(
|
||||
{
|
||||
# RemovedInDjango50Warning: when the deprecation ends, replace
|
||||
# with: 'CSRF_COOKIE': csrf_secret
|
||||
"CSRF_COOKIE": (
|
||||
_mask_cipher_secret(csrf_secret)
|
||||
if settings.CSRF_COOKIE_MASKED
|
||||
else csrf_secret
|
||||
),
|
||||
"CSRF_COOKIE_NEEDS_UPDATE": True,
|
||||
}
|
||||
)
|
||||
return csrf_secret
|
||||
|
||||
|
||||
def get_token(request):
|
||||
"""
|
||||
Return the CSRF token required for a POST form. The token is an
|
||||
alphanumeric value. A new token is created if one is not already set.
|
||||
|
||||
A side effect of calling this function is to make the csrf_protect
|
||||
decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
|
||||
header to the outgoing response. For this reason, you may need to use this
|
||||
function lazily, as is done by the csrf context processor.
|
||||
"""
|
||||
if "CSRF_COOKIE" in request.META:
|
||||
csrf_secret = request.META["CSRF_COOKIE"]
|
||||
# Since the cookie is being used, flag to send the cookie in
|
||||
# process_response() (even if the client already has it) in order to
|
||||
# renew the expiry timer.
|
||||
request.META["CSRF_COOKIE_NEEDS_UPDATE"] = True
|
||||
else:
|
||||
csrf_secret = _add_new_csrf_cookie(request)
|
||||
return _mask_cipher_secret(csrf_secret)
|
||||
|
||||
|
||||
def rotate_token(request):
|
||||
"""
|
||||
Change the CSRF token in use for a request - should be done on login
|
||||
for security purposes.
|
||||
"""
|
||||
_add_new_csrf_cookie(request)
|
||||
|
||||
|
||||
class InvalidTokenFormat(Exception):
|
||||
def __init__(self, reason):
|
||||
self.reason = reason
|
||||
|
||||
|
||||
def _check_token_format(token):
|
||||
"""
|
||||
Raise an InvalidTokenFormat error if the token has an invalid length or
|
||||
characters that aren't allowed. The token argument can be a CSRF cookie
|
||||
secret or non-cookie CSRF token, and either masked or unmasked.
|
||||
"""
|
||||
if len(token) not in (CSRF_TOKEN_LENGTH, CSRF_SECRET_LENGTH):
|
||||
raise InvalidTokenFormat(REASON_INCORRECT_LENGTH)
|
||||
# Make sure all characters are in CSRF_ALLOWED_CHARS.
|
||||
if invalid_token_chars_re.search(token):
|
||||
raise InvalidTokenFormat(REASON_INVALID_CHARACTERS)
|
||||
|
||||
|
||||
def _does_token_match(request_csrf_token, csrf_secret):
|
||||
"""
|
||||
Return whether the given CSRF token matches the given CSRF secret, after
|
||||
unmasking the token if necessary.
|
||||
|
||||
This function assumes that the request_csrf_token argument has been
|
||||
validated to have the correct length (CSRF_SECRET_LENGTH or
|
||||
CSRF_TOKEN_LENGTH characters) and allowed characters, and that if it has
|
||||
length CSRF_TOKEN_LENGTH, it is a masked secret.
|
||||
"""
|
||||
# Only unmask tokens that are exactly CSRF_TOKEN_LENGTH characters long.
|
||||
if len(request_csrf_token) == CSRF_TOKEN_LENGTH:
|
||||
request_csrf_token = _unmask_cipher_token(request_csrf_token)
|
||||
assert len(request_csrf_token) == CSRF_SECRET_LENGTH
|
||||
return constant_time_compare(request_csrf_token, csrf_secret)
|
||||
|
||||
|
||||
class RejectRequest(Exception):
|
||||
def __init__(self, reason):
|
||||
self.reason = reason
|
||||
|
||||
|
||||
class CsrfViewMiddleware(MiddlewareMixin):
|
||||
"""
|
||||
Require a present and correct csrfmiddlewaretoken for POST requests that
|
||||
have a CSRF cookie, and set an outgoing CSRF cookie.
|
||||
|
||||
This middleware should be used in conjunction with the {% csrf_token %}
|
||||
template tag.
|
||||
"""
|
||||
|
||||
@cached_property
|
||||
def csrf_trusted_origins_hosts(self):
|
||||
return [
|
||||
urlparse(origin).netloc.lstrip("*")
|
||||
for origin in settings.CSRF_TRUSTED_ORIGINS
|
||||
]
|
||||
|
||||
@cached_property
|
||||
def allowed_origins_exact(self):
|
||||
return {origin for origin in settings.CSRF_TRUSTED_ORIGINS if "*" not in origin}
|
||||
|
||||
@cached_property
|
||||
def allowed_origin_subdomains(self):
|
||||
"""
|
||||
A mapping of allowed schemes to list of allowed netlocs, where all
|
||||
subdomains of the netloc are allowed.
|
||||
"""
|
||||
allowed_origin_subdomains = defaultdict(list)
|
||||
for parsed in (
|
||||
urlparse(origin)
|
||||
for origin in settings.CSRF_TRUSTED_ORIGINS
|
||||
if "*" in origin
|
||||
):
|
||||
allowed_origin_subdomains[parsed.scheme].append(parsed.netloc.lstrip("*"))
|
||||
return allowed_origin_subdomains
|
||||
|
||||
# The _accept and _reject methods currently only exist for the sake of the
|
||||
# requires_csrf_token decorator.
|
||||
def _accept(self, request):
|
||||
# Avoid checking the request twice by adding a custom attribute to
|
||||
# request. This will be relevant when both decorator and middleware
|
||||
# are used.
|
||||
request.csrf_processing_done = True
|
||||
return None
|
||||
|
||||
def _reject(self, request, reason):
|
||||
response = _get_failure_view()(request, reason=reason)
|
||||
log_response(
|
||||
"Forbidden (%s): %s",
|
||||
reason,
|
||||
request.path,
|
||||
response=response,
|
||||
request=request,
|
||||
logger=logger,
|
||||
)
|
||||
return response
|
||||
|
||||
def _get_secret(self, request):
|
||||
"""
|
||||
Return the CSRF secret originally associated with the request, or None
|
||||
if it didn't have one.
|
||||
|
||||
If the CSRF_USE_SESSIONS setting is false, raises InvalidTokenFormat if
|
||||
the request's secret has invalid characters or an invalid length.
|
||||
"""
|
||||
if settings.CSRF_USE_SESSIONS:
|
||||
try:
|
||||
csrf_secret = request.session.get(CSRF_SESSION_KEY)
|
||||
except AttributeError:
|
||||
raise ImproperlyConfigured(
|
||||
"CSRF_USE_SESSIONS is enabled, but request.session is not "
|
||||
"set. SessionMiddleware must appear before CsrfViewMiddleware "
|
||||
"in MIDDLEWARE."
|
||||
)
|
||||
else:
|
||||
try:
|
||||
csrf_secret = request.COOKIES[settings.CSRF_COOKIE_NAME]
|
||||
except KeyError:
|
||||
csrf_secret = None
|
||||
else:
|
||||
# This can raise InvalidTokenFormat.
|
||||
_check_token_format(csrf_secret)
|
||||
if csrf_secret is None:
|
||||
return None
|
||||
# Django versions before 4.0 masked the secret before storing.
|
||||
if len(csrf_secret) == CSRF_TOKEN_LENGTH:
|
||||
csrf_secret = _unmask_cipher_token(csrf_secret)
|
||||
return csrf_secret
|
||||
|
||||
def _set_csrf_cookie(self, request, response):
|
||||
if settings.CSRF_USE_SESSIONS:
|
||||
if request.session.get(CSRF_SESSION_KEY) != request.META["CSRF_COOKIE"]:
|
||||
request.session[CSRF_SESSION_KEY] = request.META["CSRF_COOKIE"]
|
||||
else:
|
||||
response.set_cookie(
|
||||
settings.CSRF_COOKIE_NAME,
|
||||
request.META["CSRF_COOKIE"],
|
||||
max_age=settings.CSRF_COOKIE_AGE,
|
||||
domain=settings.CSRF_COOKIE_DOMAIN,
|
||||
path=settings.CSRF_COOKIE_PATH,
|
||||
secure=settings.CSRF_COOKIE_SECURE,
|
||||
httponly=settings.CSRF_COOKIE_HTTPONLY,
|
||||
samesite=settings.CSRF_COOKIE_SAMESITE,
|
||||
)
|
||||
# Set the Vary header since content varies with the CSRF cookie.
|
||||
patch_vary_headers(response, ("Cookie",))
|
||||
|
||||
def _origin_verified(self, request):
|
||||
request_origin = request.META["HTTP_ORIGIN"]
|
||||
try:
|
||||
good_host = request.get_host()
|
||||
except DisallowedHost:
|
||||
pass
|
||||
else:
|
||||
good_origin = "%s://%s" % (
|
||||
"https" if request.is_secure() else "http",
|
||||
good_host,
|
||||
)
|
||||
if request_origin == good_origin:
|
||||
return True
|
||||
if request_origin in self.allowed_origins_exact:
|
||||
return True
|
||||
try:
|
||||
parsed_origin = urlparse(request_origin)
|
||||
except ValueError:
|
||||
return False
|
||||
request_scheme = parsed_origin.scheme
|
||||
request_netloc = parsed_origin.netloc
|
||||
return any(
|
||||
is_same_domain(request_netloc, host)
|
||||
for host in self.allowed_origin_subdomains.get(request_scheme, ())
|
||||
)
|
||||
|
||||
def _check_referer(self, request):
|
||||
referer = request.META.get("HTTP_REFERER")
|
||||
if referer is None:
|
||||
raise RejectRequest(REASON_NO_REFERER)
|
||||
|
||||
try:
|
||||
referer = urlparse(referer)
|
||||
except ValueError:
|
||||
raise RejectRequest(REASON_MALFORMED_REFERER)
|
||||
|
||||
# Make sure we have a valid URL for Referer.
|
||||
if "" in (referer.scheme, referer.netloc):
|
||||
raise RejectRequest(REASON_MALFORMED_REFERER)
|
||||
|
||||
# Ensure that our Referer is also secure.
|
||||
if referer.scheme != "https":
|
||||
raise RejectRequest(REASON_INSECURE_REFERER)
|
||||
|
||||
if any(
|
||||
is_same_domain(referer.netloc, host)
|
||||
for host in self.csrf_trusted_origins_hosts
|
||||
):
|
||||
return
|
||||
# Allow matching the configured cookie domain.
|
||||
good_referer = (
|
||||
settings.SESSION_COOKIE_DOMAIN
|
||||
if settings.CSRF_USE_SESSIONS
|
||||
else settings.CSRF_COOKIE_DOMAIN
|
||||
)
|
||||
if good_referer is None:
|
||||
# If no cookie domain is configured, allow matching the current
|
||||
# host:port exactly if it's permitted by ALLOWED_HOSTS.
|
||||
try:
|
||||
# request.get_host() includes the port.
|
||||
good_referer = request.get_host()
|
||||
except DisallowedHost:
|
||||
raise RejectRequest(REASON_BAD_REFERER % referer.geturl())
|
||||
else:
|
||||
server_port = request.get_port()
|
||||
if server_port not in ("443", "80"):
|
||||
good_referer = "%s:%s" % (good_referer, server_port)
|
||||
|
||||
if not is_same_domain(referer.netloc, good_referer):
|
||||
raise RejectRequest(REASON_BAD_REFERER % referer.geturl())
|
||||
|
||||
def _bad_token_message(self, reason, token_source):
|
||||
if token_source != "POST":
|
||||
# Assume it is a settings.CSRF_HEADER_NAME value.
|
||||
header_name = HttpHeaders.parse_header_name(token_source)
|
||||
token_source = f"the {header_name!r} HTTP header"
|
||||
return f"CSRF token from {token_source} {reason}."
|
||||
|
||||
def _check_token(self, request):
|
||||
# Access csrf_secret via self._get_secret() as rotate_token() may have
|
||||
# been called by an authentication middleware during the
|
||||
# process_request() phase.
|
||||
try:
|
||||
csrf_secret = self._get_secret(request)
|
||||
except InvalidTokenFormat as exc:
|
||||
raise RejectRequest(f"CSRF cookie {exc.reason}.")
|
||||
|
||||
if csrf_secret is None:
|
||||
# No CSRF cookie. For POST requests, we insist on a CSRF cookie,
|
||||
# and in this way we can avoid all CSRF attacks, including login
|
||||
# CSRF.
|
||||
raise RejectRequest(REASON_NO_CSRF_COOKIE)
|
||||
|
||||
# Check non-cookie token for match.
|
||||
request_csrf_token = ""
|
||||
if request.method == "POST":
|
||||
try:
|
||||
request_csrf_token = request.POST.get("csrfmiddlewaretoken", "")
|
||||
except UnreadablePostError:
|
||||
# Handle a broken connection before we've completed reading the
|
||||
# POST data. process_view shouldn't raise any exceptions, so
|
||||
# we'll ignore and serve the user a 403 (assuming they're still
|
||||
# listening, which they probably aren't because of the error).
|
||||
pass
|
||||
|
||||
if request_csrf_token == "":
|
||||
# Fall back to X-CSRFToken, to make things easier for AJAX, and
|
||||
# possible for PUT/DELETE.
|
||||
try:
|
||||
# This can have length CSRF_SECRET_LENGTH or CSRF_TOKEN_LENGTH,
|
||||
# depending on whether the client obtained the token from
|
||||
# the DOM or the cookie (and if the cookie, whether the cookie
|
||||
# was masked or unmasked).
|
||||
request_csrf_token = request.META[settings.CSRF_HEADER_NAME]
|
||||
except KeyError:
|
||||
raise RejectRequest(REASON_CSRF_TOKEN_MISSING)
|
||||
token_source = settings.CSRF_HEADER_NAME
|
||||
else:
|
||||
token_source = "POST"
|
||||
|
||||
try:
|
||||
_check_token_format(request_csrf_token)
|
||||
except InvalidTokenFormat as exc:
|
||||
reason = self._bad_token_message(exc.reason, token_source)
|
||||
raise RejectRequest(reason)
|
||||
|
||||
if not _does_token_match(request_csrf_token, csrf_secret):
|
||||
reason = self._bad_token_message("incorrect", token_source)
|
||||
raise RejectRequest(reason)
|
||||
|
||||
def process_request(self, request):
|
||||
try:
|
||||
csrf_secret = self._get_secret(request)
|
||||
except InvalidTokenFormat:
|
||||
_add_new_csrf_cookie(request)
|
||||
else:
|
||||
if csrf_secret is not None:
|
||||
# Use the same secret next time. If the secret was originally
|
||||
# masked, this also causes it to be replaced with the unmasked
|
||||
# form, but only in cases where the secret is already getting
|
||||
# saved anyways.
|
||||
request.META["CSRF_COOKIE"] = csrf_secret
|
||||
|
||||
def process_view(self, request, callback, callback_args, callback_kwargs):
|
||||
if getattr(request, "csrf_processing_done", False):
|
||||
return None
|
||||
|
||||
# Wait until request.META["CSRF_COOKIE"] has been manipulated before
|
||||
# bailing out, so that get_token still works
|
||||
if getattr(callback, "csrf_exempt", False):
|
||||
return None
|
||||
|
||||
# Assume that anything not defined as 'safe' by RFC 9110 needs protection
|
||||
if request.method in ("GET", "HEAD", "OPTIONS", "TRACE"):
|
||||
return self._accept(request)
|
||||
|
||||
if getattr(request, "_dont_enforce_csrf_checks", False):
|
||||
# Mechanism to turn off CSRF checks for test suite. It comes after
|
||||
# the creation of CSRF cookies, so that everything else continues
|
||||
# to work exactly the same (e.g. cookies are sent, etc.), but
|
||||
# before any branches that call the _reject method.
|
||||
return self._accept(request)
|
||||
|
||||
# Reject the request if the Origin header doesn't match an allowed
|
||||
# value.
|
||||
if "HTTP_ORIGIN" in request.META:
|
||||
if not self._origin_verified(request):
|
||||
return self._reject(
|
||||
request, REASON_BAD_ORIGIN % request.META["HTTP_ORIGIN"]
|
||||
)
|
||||
elif request.is_secure():
|
||||
# If the Origin header wasn't provided, reject HTTPS requests if
|
||||
# the Referer header doesn't match an allowed value.
|
||||
#
|
||||
# Suppose user visits http://example.com/
|
||||
# An active network attacker (man-in-the-middle, MITM) sends a
|
||||
# POST form that targets https://example.com/detonate-bomb/ and
|
||||
# submits it via JavaScript.
|
||||
#
|
||||
# The attacker will need to provide a CSRF cookie and token, but
|
||||
# that's no problem for a MITM and the session-independent secret
|
||||
# we're using. So the MITM can circumvent the CSRF protection. This
|
||||
# is true for any HTTP connection, but anyone using HTTPS expects
|
||||
# better! For this reason, for https://example.com/ we need
|
||||
# additional protection that treats http://example.com/ as
|
||||
# completely untrusted. Under HTTPS, Barth et al. found that the
|
||||
# Referer header is missing for same-domain requests in only about
|
||||
# 0.2% of cases or less, so we can use strict Referer checking.
|
||||
try:
|
||||
self._check_referer(request)
|
||||
except RejectRequest as exc:
|
||||
return self._reject(request, exc.reason)
|
||||
|
||||
try:
|
||||
self._check_token(request)
|
||||
except RejectRequest as exc:
|
||||
return self._reject(request, exc.reason)
|
||||
|
||||
return self._accept(request)
|
||||
|
||||
def process_response(self, request, response):
|
||||
if request.META.get("CSRF_COOKIE_NEEDS_UPDATE"):
|
||||
self._set_csrf_cookie(request, response)
|
||||
# Unset the flag to prevent _set_csrf_cookie() from being
|
||||
# unnecessarily called again in process_response() by other
|
||||
# instances of CsrfViewMiddleware. This can happen e.g. when both a
|
||||
# decorator and middleware are used. However,
|
||||
# CSRF_COOKIE_NEEDS_UPDATE is still respected in subsequent calls
|
||||
# e.g. in case rotate_token() is called in process_response() later
|
||||
# by custom middleware but before those subsequent calls.
|
||||
request.META["CSRF_COOKIE_NEEDS_UPDATE"] = False
|
||||
|
||||
return response
|
||||
@ -0,0 +1,74 @@
|
||||
from django.utils.cache import patch_vary_headers
|
||||
from django.utils.deprecation import MiddlewareMixin
|
||||
from django.utils.regex_helper import _lazy_re_compile
|
||||
from django.utils.text import compress_sequence, compress_string
|
||||
|
||||
re_accepts_gzip = _lazy_re_compile(r"\bgzip\b")
|
||||
|
||||
|
||||
class GZipMiddleware(MiddlewareMixin):
|
||||
"""
|
||||
Compress content if the browser allows gzip compression.
|
||||
Set the Vary header accordingly, so that caches will base their storage
|
||||
on the Accept-Encoding header.
|
||||
"""
|
||||
|
||||
max_random_bytes = 100
|
||||
|
||||
def process_response(self, request, response):
|
||||
# It's not worth attempting to compress really short responses.
|
||||
if not response.streaming and len(response.content) < 200:
|
||||
return response
|
||||
|
||||
# Avoid gzipping if we've already got a content-encoding.
|
||||
if response.has_header("Content-Encoding"):
|
||||
return response
|
||||
|
||||
patch_vary_headers(response, ("Accept-Encoding",))
|
||||
|
||||
ae = request.META.get("HTTP_ACCEPT_ENCODING", "")
|
||||
if not re_accepts_gzip.search(ae):
|
||||
return response
|
||||
|
||||
if response.streaming:
|
||||
if response.is_async:
|
||||
# pull to lexical scope to capture fixed reference in case
|
||||
# streaming_content is set again later.
|
||||
orignal_iterator = response.streaming_content
|
||||
|
||||
async def gzip_wrapper():
|
||||
async for chunk in orignal_iterator:
|
||||
yield compress_string(
|
||||
chunk,
|
||||
max_random_bytes=self.max_random_bytes,
|
||||
)
|
||||
|
||||
response.streaming_content = gzip_wrapper()
|
||||
else:
|
||||
response.streaming_content = compress_sequence(
|
||||
response.streaming_content,
|
||||
max_random_bytes=self.max_random_bytes,
|
||||
)
|
||||
# Delete the `Content-Length` header for streaming content, because
|
||||
# we won't know the compressed size until we stream it.
|
||||
del response.headers["Content-Length"]
|
||||
else:
|
||||
# Return the compressed content only if it's actually shorter.
|
||||
compressed_content = compress_string(
|
||||
response.content,
|
||||
max_random_bytes=self.max_random_bytes,
|
||||
)
|
||||
if len(compressed_content) >= len(response.content):
|
||||
return response
|
||||
response.content = compressed_content
|
||||
response.headers["Content-Length"] = str(len(response.content))
|
||||
|
||||
# If there is a strong ETag, make it weak to fulfill the requirements
|
||||
# of RFC 9110 Section 8.8.1 while also allowing conditional request
|
||||
# matches on ETags.
|
||||
etag = response.get("ETag")
|
||||
if etag and etag.startswith('"'):
|
||||
response.headers["ETag"] = "W/" + etag
|
||||
response.headers["Content-Encoding"] = "gzip"
|
||||
|
||||
return response
|
||||
@ -0,0 +1,40 @@
|
||||
from django.utils.cache import cc_delim_re, get_conditional_response, set_response_etag
|
||||
from django.utils.deprecation import MiddlewareMixin
|
||||
from django.utils.http import parse_http_date_safe
|
||||
|
||||
|
||||
class ConditionalGetMiddleware(MiddlewareMixin):
|
||||
"""
|
||||
Handle conditional GET operations. If the response has an ETag or
|
||||
Last-Modified header and the request has If-None-Match or If-Modified-Since,
|
||||
replace the response with HttpNotModified. Add an ETag header if needed.
|
||||
"""
|
||||
|
||||
def process_response(self, request, response):
|
||||
# It's too late to prevent an unsafe request with a 412 response, and
|
||||
# for a HEAD request, the response body is always empty so computing
|
||||
# an accurate ETag isn't possible.
|
||||
if request.method != "GET":
|
||||
return response
|
||||
|
||||
if self.needs_etag(response) and not response.has_header("ETag"):
|
||||
set_response_etag(response)
|
||||
|
||||
etag = response.get("ETag")
|
||||
last_modified = response.get("Last-Modified")
|
||||
last_modified = last_modified and parse_http_date_safe(last_modified)
|
||||
|
||||
if etag or last_modified:
|
||||
return get_conditional_response(
|
||||
request,
|
||||
etag=etag,
|
||||
last_modified=last_modified,
|
||||
response=response,
|
||||
)
|
||||
|
||||
return response
|
||||
|
||||
def needs_etag(self, response):
|
||||
"""Return True if an ETag header should be added to response."""
|
||||
cache_control_headers = cc_delim_re.split(response.get("Cache-Control", ""))
|
||||
return all(header.lower() != "no-store" for header in cache_control_headers)
|
||||
@ -0,0 +1,80 @@
|
||||
from django.conf import settings
|
||||
from django.conf.urls.i18n import is_language_prefix_patterns_used
|
||||
from django.http import HttpResponseRedirect
|
||||
from django.urls import get_script_prefix, is_valid_path
|
||||
from django.utils import translation
|
||||
from django.utils.cache import patch_vary_headers
|
||||
from django.utils.deprecation import MiddlewareMixin
|
||||
|
||||
|
||||
class LocaleMiddleware(MiddlewareMixin):
|
||||
"""
|
||||
Parse a request and decide what translation object to install in the
|
||||
current thread context. This allows pages to be dynamically translated to
|
||||
the language the user desires (if the language is available).
|
||||
"""
|
||||
|
||||
response_redirect_class = HttpResponseRedirect
|
||||
|
||||
def process_request(self, request):
|
||||
urlconf = getattr(request, "urlconf", settings.ROOT_URLCONF)
|
||||
(
|
||||
i18n_patterns_used,
|
||||
prefixed_default_language,
|
||||
) = is_language_prefix_patterns_used(urlconf)
|
||||
language = translation.get_language_from_request(
|
||||
request, check_path=i18n_patterns_used
|
||||
)
|
||||
language_from_path = translation.get_language_from_path(request.path_info)
|
||||
if (
|
||||
not language_from_path
|
||||
and i18n_patterns_used
|
||||
and not prefixed_default_language
|
||||
):
|
||||
language = settings.LANGUAGE_CODE
|
||||
translation.activate(language)
|
||||
request.LANGUAGE_CODE = translation.get_language()
|
||||
|
||||
def process_response(self, request, response):
|
||||
language = translation.get_language()
|
||||
language_from_path = translation.get_language_from_path(request.path_info)
|
||||
urlconf = getattr(request, "urlconf", settings.ROOT_URLCONF)
|
||||
(
|
||||
i18n_patterns_used,
|
||||
prefixed_default_language,
|
||||
) = is_language_prefix_patterns_used(urlconf)
|
||||
|
||||
if (
|
||||
response.status_code == 404
|
||||
and not language_from_path
|
||||
and i18n_patterns_used
|
||||
and prefixed_default_language
|
||||
):
|
||||
# Maybe the language code is missing in the URL? Try adding the
|
||||
# language prefix and redirecting to that URL.
|
||||
language_path = "/%s%s" % (language, request.path_info)
|
||||
path_valid = is_valid_path(language_path, urlconf)
|
||||
path_needs_slash = not path_valid and (
|
||||
settings.APPEND_SLASH
|
||||
and not language_path.endswith("/")
|
||||
and is_valid_path("%s/" % language_path, urlconf)
|
||||
)
|
||||
|
||||
if path_valid or path_needs_slash:
|
||||
script_prefix = get_script_prefix()
|
||||
# Insert language after the script prefix and before the
|
||||
# rest of the URL
|
||||
language_url = request.get_full_path(
|
||||
force_append_slash=path_needs_slash
|
||||
).replace(script_prefix, "%s%s/" % (script_prefix, language), 1)
|
||||
# Redirect to the language-specific URL as detected by
|
||||
# get_language_from_request(). HTTP caches may cache this
|
||||
# redirect, so add the Vary header.
|
||||
redirect = self.response_redirect_class(language_url)
|
||||
patch_vary_headers(redirect, ("Accept-Language", "Cookie"))
|
||||
return redirect
|
||||
|
||||
if not (i18n_patterns_used and language_from_path):
|
||||
patch_vary_headers(response, ("Accept-Language",))
|
||||
response.headers.setdefault("Content-Language", language)
|
||||
return response
|
||||
@ -0,0 +1,66 @@
|
||||
import re
|
||||
|
||||
from django.conf import settings
|
||||
from django.http import HttpResponsePermanentRedirect
|
||||
from django.utils.deprecation import MiddlewareMixin
|
||||
|
||||
|
||||
class SecurityMiddleware(MiddlewareMixin):
|
||||
def __init__(self, get_response):
|
||||
super().__init__(get_response)
|
||||
self.sts_seconds = settings.SECURE_HSTS_SECONDS
|
||||
self.sts_include_subdomains = settings.SECURE_HSTS_INCLUDE_SUBDOMAINS
|
||||
self.sts_preload = settings.SECURE_HSTS_PRELOAD
|
||||
self.content_type_nosniff = settings.SECURE_CONTENT_TYPE_NOSNIFF
|
||||
self.redirect = settings.SECURE_SSL_REDIRECT
|
||||
self.redirect_host = settings.SECURE_SSL_HOST
|
||||
self.redirect_exempt = [re.compile(r) for r in settings.SECURE_REDIRECT_EXEMPT]
|
||||
self.referrer_policy = settings.SECURE_REFERRER_POLICY
|
||||
self.cross_origin_opener_policy = settings.SECURE_CROSS_ORIGIN_OPENER_POLICY
|
||||
|
||||
def process_request(self, request):
|
||||
path = request.path.lstrip("/")
|
||||
if (
|
||||
self.redirect
|
||||
and not request.is_secure()
|
||||
and not any(pattern.search(path) for pattern in self.redirect_exempt)
|
||||
):
|
||||
host = self.redirect_host or request.get_host()
|
||||
return HttpResponsePermanentRedirect(
|
||||
"https://%s%s" % (host, request.get_full_path())
|
||||
)
|
||||
|
||||
def process_response(self, request, response):
|
||||
if (
|
||||
self.sts_seconds
|
||||
and request.is_secure()
|
||||
and "Strict-Transport-Security" not in response
|
||||
):
|
||||
sts_header = "max-age=%s" % self.sts_seconds
|
||||
if self.sts_include_subdomains:
|
||||
sts_header += "; includeSubDomains"
|
||||
if self.sts_preload:
|
||||
sts_header += "; preload"
|
||||
response.headers["Strict-Transport-Security"] = sts_header
|
||||
|
||||
if self.content_type_nosniff:
|
||||
response.headers.setdefault("X-Content-Type-Options", "nosniff")
|
||||
|
||||
if self.referrer_policy:
|
||||
# Support a comma-separated string or iterable of values to allow
|
||||
# fallback.
|
||||
response.headers.setdefault(
|
||||
"Referrer-Policy",
|
||||
",".join(
|
||||
[v.strip() for v in self.referrer_policy.split(",")]
|
||||
if isinstance(self.referrer_policy, str)
|
||||
else self.referrer_policy
|
||||
),
|
||||
)
|
||||
|
||||
if self.cross_origin_opener_policy:
|
||||
response.setdefault(
|
||||
"Cross-Origin-Opener-Policy",
|
||||
self.cross_origin_opener_policy,
|
||||
)
|
||||
return response
|
||||
Reference in New Issue
Block a user