Tornado 用户身份验证框架

时间 2019-11-08

原文原文链接

一、安全cookie机制html

import tornado.web

session_id = 1
class MainHandler(tornado.web.RequestHandler):

    def get(self):
　　　　 global session_id　
        if not self.get_cookie('session'):
            self.set_cookie('session',str(session_id))
            session_id = session_id + 1
            self.write('你设置了一个新的session')
        else:
            self.write('你已经获取了session')

为了防止客户端篡改，随意解析cookie的键值web

import tornado.web
import tornado.ioloop
session_id = 1
class MainHandler(tornado.web.RequestHandler):
    def get(self):
        global session_id
        if not self.get_secure_cookie('session'):
            self.set_secure_cookie('session',str(session_id))
            session_id = session_id+1
            self.write('你设置了一个新的session')
        else:
            self.write('你已经获取了session')
application = tornado.web.Application([(r'/',MainHandler),],cookie_secret = 'mimi') # 设置密钥

def main():
    application.listen(8888)
    tornado.ioloop.IOLoop.current().start()

if __name__ =='__main__':
    main()

二、用户身份认证flask

tornado和flask同样，在requestHandler中current_user保存当前请求用户名，但默认值时空，须要用requestHandler.get_current_user属性设置该属性安全

import tornado.web
import tornado.ioloop
import uuid  # uuid生成库

dict_sessions = {}  # 保存全部登录的session

class BaseHandler(tornado.web.RequestHandler):
    def get_current_user(self):  # 写入current_user函数
        session_id = self.get_secure_cookie('session')
        return dict_sessions.get(session_id)

class MainHandler(BaseHandler):
    @tornado.web.authenticated  # 须要身份认证才能访问的处理器
    def get(self):
        name = tornado.escape.xhtml_escape(self.current_user)  # 自动转义
        self.write('hello' + name)

class LoginHandler(BaseHandler):
    def get(self):
        self.write(
            '<html><body><form action="/login" method = "post">Name:<input type = "text" name = "name">:<input type = "submit" value = "sign in"></form></body></html>')

    def post(self):
        if len(self.get_argument('name')) < 3:
            self.redirect('/login')
        session_id = str(uuid.uuid1())
        dict_sessions[session_id] = self.get_argument('name')
        self.set_secure_cookie('session_id', session_id)
        self.redirect('/')

application = tornado.web.Application([(r'/', MainHandler), (r'/login', LoginHandler), ], cookie_secret='mimi',
                                      login_url='/login')

def main():
    application.listen(8888)
    tornado.ioloop.IOLoop.current().start()

if __name__ == '__main__':
    main()

防止跨站攻击cookie

一、在实例化tornado.web.Application传入xsrf_cookies=True参数session

application = tornado.web.Application([(r'/', MainHandler), (r'/login', LoginHandler), ], cookie_secret='mimi',
                                      login_url='/login',xsrf_cookies=True)

二、在每一个HTML表单模板文件中为全部表单添加xsrf_form_html()函数标签app

<form action="/login" method="post">
    {% module xsrf_form_html() %}
    <input type="text" name="message">
    <input type="submit" value="post">
</form>