【DRF-06】rest-framework之节流
- 1.自定义节流类，基于用户IP限制访问频率
- 1.1:自定义节流类
import time
VISIT_RECORD = {}
class VisitThrottle(BaseThrottle):
'''
#（1）取出访问者ip
#（2）判断当前ip不在访问字典里，添加进去，并且直接返回True,表示第一次访问，在字典里，继续往下走
#（3）循环判断当前ip的列表，有值，并且当前时间减去列表的最后一个时间大于60s，把这种数据pop掉，这样列表中只有60s以内的访问时间，
#（4）判断，当列表小于3，说明一分钟以内访问不足三次，把当前时间插入到列表第一个位置，返回True，顺利通过
#（5）当大于等于3，说明一分钟内访问超过三次，返回False验证失败
'''
def __init__(self):
self.history = None
def allow_request(self,request,view):
# 1. 获取用户IP
remote_addr = self.get_ident(request)
ctime = time.time()
if remote_addr not in VISIT_RECORD:
VISIT_RECORD[remote_addr] = [ctime,]
return True
history = VISIT_RECORD.get(remote_addr)
self.history = history
while history and history[-1] < ctime - 60:
history.pop()
if len(history) < 3:
history.insert(0,ctime)
return True
# return True # 表示可以继续访问
# return False # 表示访问频率太高，被限制
def wait(self):
# 还需要等多少秒才能访问
ctime = time.time()
return 60 - (ctime - self.history[-1])
- 1.2：使用
class AuthView(APIView):
"""
用于用户登录认证
"""
authentication_classes = []
permission_classes = []
throttle_classes = [VisitThrottle,]
def post(self,request,*args,**kwargs):
ret = {'code':1000,'msg':None}
try:
user = request._request.POST.get('username')
pwd = request._request.POST.get('password')
print(user,pwd)
print(request._request.POST)
obj = models.UserInfo.objects.filter(username=user,password=pwd).first()
if not obj:
ret['code'] = 1001
ret['msg'] = "用户名或密码错误"
# 为登录用户创建token
token = md5(user)
# 存在就更新，不存在就创建
models.UserToken.objects.update_or_create(user=obj,defaults={'token':token})
ret['token'] = token
except Exception as e:
ret['code'] = 1002
ret['msg'] = '请求异常'
return JsonResponse(ret)
1.3:效果
2.内置节流类
- 2.1:自定义类继承：SimpleRateThrottle，实现：get_cache_key、scope = "keyvalue"（配置文件中的key）
- 2.2:定义
from rest_framework.throttling import BaseThrottle,SimpleRateThrottle
class VisitThrottle(SimpleRateThrottle):
scope = "no_login"
def get_cache_key(self, request, view):
return self.get_ident(request)
- 2.3:setting.py
REST_FRAMEWORK = {
# 全局使用的认证类
"DEFAULT_AUTHENTICATION_CLASSES":['app01.utils.auth.FirstAuthtication','app01.utils.auth.Authtication', ],
# "DEFAULT_AUTHENTICATION_CLASSES":['app01.utils.auth.FirstAuthtication', ],
# "UNAUTHENTICATED_USER":lambda :"匿名用户"
"UNAUTHENTICATED_USER":None, # 匿名，request.user = None
"UNAUTHENTICATED_TOKEN":None,# 匿名，request.auth = None
"DEFAULT_PERMISSION_CLASSES":['app01.utils.permission.SVIPPermission',],
"DEFAULT_THROTTLE_CLASSES":["app01.utils.throttle.VisitThrottle"],
"DEFAULT_THROTTLE_RATES":{
"NoLogin":'3/m',
},
}
- 3.节流源码流程
def check_throttles(self, request):
"""
Check if request should be throttled.
Raises an appropriate exception if the request is throttled.
"""
throttle_durations = []
for throttle in self.get_throttles():
if not throttle.allow_request(request, self):
throttle_durations.append(throttle.wait())
- 4.内置节流类源码
- 4.1:源码节流类
- 4.2：请求进来，先执行SimpleRateThrottle的__init__()方法
- 4.1:源码节流类
class SimpleRateThrottle(BaseThrottle):
cache = default_cache
timer = time.time
cache_format = 'throttle_%(scope)s_%(ident)s'
scope = None
THROTTLE_RATES = api_settings.DEFAULT_THROTTLE_RATES
def __init__(self):
if not getattr(self, 'rate', None):
self.rate = self.get_rate()
self.num_requests, self.duration = self.parse_rate(self.rate)
- 4.3：执行get_rate()赋值给rate
def get_rate(self):
"""
Determine the string representation of the allowed request rate.
"""
if not getattr(self, 'scope', None):
msg = ("You must set either `.scope` or `.rate` for '%s' throttle" %
self.__class__.__name__)
raise ImproperlyConfigured(msg)
try:
return self.THROTTLE_RATES[self.scope] # 全局配置DEFAULT_THROTTLE_RATES
except KeyError:
msg = "No default throttle rate set for '%s' scope" % self.scope
raise ImproperlyConfigured(msg)
- 4.3：执行parse_rate方法，赋值给self.num_requests, self.duration，分别为次数，时间
def parse_rate(self, rate):
"""
Given the request rate string, return a two tuple of:
<allowed number of requests>, <period of time in seconds>
"""
if rate is None:
return (None, None)
num, period = rate.split('/')
num_requests = int(num)
duration = {'s': 1, 'm': 60, 'h': 3600, 'd': 86400}[period[0]]
return (num_requests, duration)
- 4.4:执行allow_request和await方法
def allow_request(self, request, view):
"""
Implement the check to see if the request should be throttled.
On success calls `throttle_success`.
On failure calls `throttle_failure`.
"""
if self.rate is None:
return True
# 如果没有get_cache_key方法，直接返回True，继续下一个节流校验
self.key = self.get_cache_key(request, view)
if self.key is None:
return True
# 如果有，取历史记录
self.history = self.cache.get(self.key, [])
self.now = self.timer()
# Drop any requests from the history which have now passed the
# throttle duration
# 如果有历史记录，并且历史记录的最后一个时间点小于当前实际减掉节流配置实际，剔除最后一个值
while self.history and self.history[-1] <= self.now - self.duration:
self.history.pop()
# 如果历史记录次数大于节流设置次数，抛出异常
if len(self.history) >= self.num_requests:
return self.throttle_failure()
return self.throttle_success()
def wait(self):
"""
Returns the recommended next request time in seconds.
"""
if self.history:
remaining_duration = self.duration - (self.now - self.history[-1])
else:
remaining_duration = self.duration
available_requests = self.num_requests - len(self.history) + 1
if available_requests <= 0:
return None
- 4.5:节流类，在setting中最好不要配置多个自定义类，例如：匿名用户控制3/m，登录用户10/m，只会走一个。
