16:django conditional View processing (last-modified and ETag) && cryptographic signatures

Conditional View Processing

In the previous section we introduced the cache to reduce the burden on the server, where the conditional view processing also to some extent alleviate the burden of the server, before the formal introduction, first look at two concepts: last-modified and ETag

Last-modified when the browser requests a URL for the first time, the server-side return status is 200, the content is the resource requested by the client, and there is a last-modified attribute that marks the last time the file was modified at the end of the service period. The format is similar to this: Last-modified:fri, 2006 18:53:33 GMT when the client requests this URL for the second time, according to the HTTP protocol, the browser transmits the If-modified-since header to the server, Ask if the file has been modified since: If-modified-since:fri, 2006 18:53:33 GMT if the server-side resource does not change, the HTTP 304 (not Changed.) Status code is automatically returned, so the content is empty, so Saves the amount of data transferred. When the server-side code changes or restarts the server, the resource is re-emitted, similar to when the first request is returned. This ensures that the resources are not duplicated to the client, and that the client is able to get the latest resources when the server changes. ETagRequest ProcessThe etag is generated by the server side, and the client verifies that the resource is modified by if-match or if-none-match this condition to determine the request. It is common to use if-none-match. The process of requesting a file may be as follows: = = = = = = = = = = = = = = ===1. The client initiates an HTTP GET request for a file; 2. The server processes the request, returns the file contents and a bunch of headers, of course including the ETag ( 2e681a-6-5d044840 ") (assuming the server supports ETag generation and the ETag has been turned on). Status Code 200==== the second request ===1. Client initiates an HTTP GET request for a file, Note that this time the client sends a If-none-match header at the same time, The content of this header is the etag:2e681a-6-5d0448402 returned by the server on the first request. The server determines the etag sent over and computes the ETag match, so If-none-match is false, returns 200, returns 304, the client continues to use the local cache; Simple, the question is, if the server set up Cache-control:max-age and expires, how to do? The answer is to use it at the same time, meaning that the server can return 304 after the modification time and ETag are fully matched if-modified-since and If-none-match. (Do not fall into the end use of the problem of the circle) role of the etag mainly in order to solve some problems last-modified can not solve. 1, some files may change periodically, but his content does not change (only change the modified time), this time we do not want the client to think that the file has been modified, and re-get;2, some files are modified very frequently, such as in the time of the second to modify, for example, 1s modified n times , if-modified-since can check the granularity is S-class, this modification can not be judged (or the UNIX record mtime can only be accurate to seconds) 3, some servers can not accurately get the last modification time of the file; To this end, http/1.1 introduced the Etag (Entity Tags). The etag is just a file-related tag, which can be a version tag, such as v1.0.0 or "2e681a-6-5d044840", a string of seemingly cryptic encodings. But the http/1.1 standard does not specify what the ETag content is or how it is to be implemented, the only provision is that the etag needs to be placed in the "".

Knowing these two concepts, we should know what the two concepts are, and we probably know what we're going to be explaining next. Yes, how do you use the concepts of last-modified and ETag in Django?

Condition Decorator

Last-modified and ETag are two functions in Django that return a date type data, which returns a value (ETag value). These two functions can be passed as parameters to the Django.views.decorators.http.condition, the adorner prototype is

Condition (Etag_func=none, Last_modified_func=none)

This is a simple example of using

def latest_entry (Request, blog_id):     return Entry.objects.filter (blog=blog_id). Latest ("published"). Publishedfrom  Import  condition@condition (last_modified_func=latest_entry)def front_page (Request, blog_id):    ...

In the Django.views.decorators.http.condition file also provides two other adorners, can make only need to provide a parameter, see the source is easy to understand:

def ETag (etag_func):     return condition (etag_func=etag_func)def  last_modified (last_modified_func):     return condition (last_modified_func=last_modified_func)

Finished last-modified and ETag, let's go on.

Django Encrypted signature

The golden Rule of Web Application security is: Never trust data from untrusted sources. But sometimes we can only get or send data from untrusted media, or the untrusted medium is more attractive, such as we make sure our data is secure, and untrusted media is much quicker or cheaper than trusted media. Once the value of the encrypted signature is tampered with, it is detected, which is a common understanding that we can ensure data security. Here are some examples of cryptographic signature applications:

• The URL used to retrieve the password
• Make sure the hidden fields in form form are not modified
• One-time encrypted URL to allow access to protected data

Django provides an underlying API for encrypting data and a high-level API for setting up and reading encrypted cookies.

Protect your secret_key.

The project generated with the django-admin.py startproject command comes with an automatically randomly generated secret_key, and be careful not to divulge this KEY

Using low-level APIs

The Django encryption method source code is located in the Django\core directory of the signing.py file, can be specific to see, the following are some basic usage:

>>> fromDjango.confImportSettings>>>settings.configure ()>>> fromDjango.core.signingImportsigner>>> signer =signer ()>>> value = Signer.sign ("Qiweijie")>>>value'Qiweijie:lvrpb11e1k9k_dcxnmgnyk8t2aq'>>> original =signer.unsign (value)>>>Originalu'Qiweijie'

Use the "flavoring" parameter (salt)

Salt is the meaning of "salt, flavoring Agent", if you do not want to encrypt the same character every time the results are the same, then you can be used to adjust the flavor parameters, haha, look at the example:

>>> signer =signer ()>>> Signer.sign ('My String')'My string:gdmgd6hnq_qdgxyp8ybzadaiv1w'>>> signer = signer (salt='Extra')>>> Signer.sign ('My String')'My STRING:EE7VGI-ING6N02GKCJ-QLHG6VFW'>>> Signer.unsign ('My STRING:EE7VGI-ING6N02GKCJ-QLHG6VFW') U'My String'

Validating timestamps

Timestampsigner is a subclass of signer that adds an encrypted timestamp to the value. This allows you to ensure that an encrypted data is created within a given time

>>> fromDjango.core.signingImportTimestampsigner>>> signer =Timestampsigner ()>>> value = Signer.sign ('Hello')>>>value'hello:1nmg5h:opvucqljwmchm1ra2lytutelc-c'>>>signer.unsign (value) u'Hello'>>> signer.unsign (Value, max_age=10)... Signatureexpired:signature Age15.5289158821 > 10seconds>>> signer.unsign (Value, max_age=20) U'Hello'

Protection of complex data structures

Lists, tuples, and dictionaries, if you use the above method directly, you get a string instead of the original data type:

>>> dic = {1:2}>>> sd=signer.sign (DIC)>>> signer.unsign (SD) u ' {1:2} '

If you want to protect these data types, use the dumps and loads methods, which are all in the Django.core.signing module

dumps ( obj, key=none, salt= ' django.core.signing ', compress=false)

loads ( string, key=none, salt= ' django.core.signing ', max_age=none)

>>> fromDjango.coreImportsigning>>> value = Signing.dumps ({"Foo":"Bar"})>>>value'Eyjmb28ioijiyxiifq:1nmg1b:zgcde4-tckaegzlew9uqwzescii'>>>Signing.loads (value) {'Foo':'Bar'}

16:django conditional View processing (last-modified and ETag) && cryptographic signatures