#Django安全最佳实践 - 防护常见Web安全漏洞

"""
OWASP Top 10 (2021) 安全威胁：

1. 失效的访问控制 (Broken Access Control)
2. 加密货币缺陷 (Cryptographic Failures)
3. 注入 (Injection)
4. 不安全的设计 (Insecure Design)
5. 安全配置错误 (Security Misconfiguration)
6. 易受攻击的和过时的组件 (Vulnerable and Outdated Components)
7. 身份验证失败 (Identification and Authentication Failures)
8. 软件和数据完整性故障 (Software and Data Integrity Failures)
9. 安全日志记录不足 (Security Logging Failures)
10. 服务器端请求伪造 (Server-Side Request Forgery)

Django内置机制可防护：
- 注入 (SQL Injection, XSS)
- CSRF
- 点击劫持
- 恶意文件上传
- 会话固定攻击
"""

"""
Django安全架构组成：

1. 输入验证层
   - 表单验证
   - 模型验证
   - 中间件验证

2. 输出编码层
   - 模板自动转义
   - HTML/XML编码
   - JSON编码

3. 访问控制层
   - 装饰器
   - 混入类
   - 权限系统

4. 数据保护层
   - 密码哈希
   - 会话安全
   - CSRF令牌

5. 配置管理层
   - 安全设置
   - HTTPS配置
   - CORS策略
"""

"""
安全开发核心原则：

1. 最小权限原则 (Principle of Least Privilege)
   - 只授予必要的权限
   - 避免使用超级用户权限
   - 按需分配权限

2. 深度防御原则 (Defense in Depth)
   - 多层防护机制
   - 即使一层被突破仍有其他防护
   - 综合使用多种安全措施

3. 失效安全原则 (Fail Securely)
   - 默认拒绝访问
   - 安全检查失败时拒绝请求
   - 不暴露敏感信息

4. 验证和清理原则 (Validate and Sanitize)
   - 验证所有输入
   - 清理所有输出
   - 使用白名单验证
"""

"""
XSS (Cross-Site Scripting) 攻击类型：

1. 存储型XSS (Persistent/Stored XSS)
   - 恶意脚本存储在服务器
   - 持久性攻击
   - 影响所有访问者

2. 反射型XSS (Reflected XSS)
   - 恶意脚本通过URL反射
   - 需要用户点击恶意链接
   - 一次性攻击

3. DOM型XSS (DOM-based XSS)
   - 客户端JavaScript漏洞
   - 不经过服务器处理
   - 修改DOM结构

XSS攻击危害：
- 窃取用户Cookie
- 重定向到恶意网站
- 修改页面内容
- 执行恶意操作
"""

# Django模板自动转义机制
"""
Django模板系统默认启用了自动转义功能，
所有变量输出都会进行HTML转义，防止XSS攻击。

转义规则：
- < → <
- > → >
- & → &
- " → "
- ' → &#x27;
- / → &#x2F;

示例：
{{ user_input }}  # 自动转义
{{ user_input|safe }}  # 禁用转义（危险！）
{{ user_input|escape }}  # 显式转义
"""

# 安全的模板实践示例
from django import template
from django.utils.safestring import mark_safe
import html
import re

register = template.Library()

# 安全的富文本处理
@register.filter
def safe_html_filter(text):
    """安全的HTML过滤器"""
    if not text:
        return ''
    
    # 只允许安全的HTML标签
    allowed_tags = {
        'p', 'br', 'strong', 'em', 'u', 'ol', 'ul', 'li',
        'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'blockquote',
        'code', 'pre', 'hr', 'div', 'span', 'a'
    }
    
    # 只允许安全的属性
    allowed_attrs = {
        'a': ['href', 'title', 'target'],
        'img': ['src', 'alt', 'title', 'width', 'height'],
        'div': ['class', 'id'],
        'span': ['class', 'id'],
        'p': ['class', 'id'],
    }
    
    # 使用BeautifulSoup进行安全的HTML清理
    try:
        from bs4 import BeautifulSoup
        soup = BeautifulSoup(text, 'html.parser')
        
        # 移除所有不在允许列表中的标签
        for tag in soup.find_all(True):
            if tag.name not in allowed_tags:
                tag.unwrap()  # 移除标签但保留内容
            
            # 清理标签属性
            if tag.name in allowed_attrs:
                allowed = allowed_attrs[tag.name]
                for attr in list(tag.attrs.keys()):
                    if attr not in allowed:
                        del tag[attr]
            else:
                tag.attrs = {}
        
        return mark_safe(str(soup))
    except ImportError:
        # 如果没有BeautifulSoup，使用基本转义
        return mark_safe(html.escape(text))

# 安全的URL处理
@register.filter
def safe_url(url):
    """安全的URL过滤器"""
    if not url:
        return ''
    
    # 只允许安全的协议
    safe_protocols = ['http://', 'https://', 'mailto:', '#', '/']
    url_lower = url.lower().strip()
    
    for protocol in safe_protocols:
        if url_lower.startswith(protocol):
            return url
    
    # 不安全的URL返回空字符串
    return ''

# 自定义安全标签
@register.simple_tag
def safe_markdown(text):
    """安全的Markdown渲染"""
    if not text:
        return ''
    
    try:
        import markdown
        from markdown.extensions import Extension
        
        # 使用安全的Markdown配置
        md = markdown.Markdown(
            extensions=[
                'markdown.extensions.extra',
                'markdown.extensions.codehilite',
                'markdown.extensions.toc',
            ],
            safe_mode='escape',  # 转义HTML
        )
        
        html_content = md.convert(text)
        
        # 进一步清理HTML
        soup = BeautifulSoup(html_content, 'html.parser')
        
        # 移除script标签
        for script in soup(["script", "style"]):
            script.decompose()
        
        return mark_safe(str(soup))
    except ImportError:
        # 如果没有markdown库，返回转义的文本
        return mark_safe(html.escape(text))

# 使用示例的视图
from django.shortcuts import render
from django.utils.html import escape
from django.http import HttpResponseBadRequest

def safe_xss_demo(request):
    """XSS防护演示"""
    if request.method == 'POST':
        user_input = request.POST.get('user_input', '')
        
        # 服务器端验证
        if len(user_input) > 1000:
            return HttpResponseBadRequest('输入内容过长')
        
        # 基本的恶意内容检测
        dangerous_patterns = [
            r'<script.*?>.*?</script>',
            r'javascript:',
            r'on\w+\s*=',
            r'<iframe.*?>',
            r'<object.*?>',
            r'<embed.*?>',
        ]
        
        import re
        for pattern in dangerous_patterns:
            if re.search(pattern, user_input, re.IGNORECASE):
                return HttpResponseBadRequest('检测到潜在的恶意内容')
        
        # 清理和验证后的数据
        cleaned_input = escape(user_input)
        
        context = {
            'user_input': cleaned_input,
            'display_input': user_input,  # 在模板中会被自动转义
        }
        
        return render(request, 'safe_xss_demo.html', context)
    
    return render(request, 'safe_xss_form.html')

"""
安全的模板示例 (safe_xss_demo.html)：

<!DOCTYPE html>
<html>
<head>
    <title>XSS防护演示</title>
</head>
<body>
    <h1>XSS防护演示</h1>
    
    <!-- Django会自动转义这个变量 -->
    <p>安全显示: {{ user_input }}</p>
    
    <!-- 使用安全过滤器 -->
    <div>安全HTML: {{ display_input|safe_html_filter }}</div>
    
    <!-- 显式转义 -->
    <p>显式转义: {{ display_input|escape }}</p>
</body>
</html>
"""

# 内容安全策略中间件
from django.utils.deprecation import MiddlewareMixin
from django.conf import settings

class ContentSecurityPolicyMiddleware(MiddlewareMixin):
    """内容安全策略中间件"""
    
    def process_response(self, request, response):
        # 只对HTML响应添加CSP头
        if response.get('Content-Type', '').startswith('text/html'):
            csp_policy = self.get_csp_policy(request)
            response['Content-Security-Policy'] = csp_policy
        
        return response
    
    def get_csp_policy(self, request):
        """生成CSP策略"""
        # 基础策略
        policies = [
            "default-src 'self'",  # 默认只允许同源资源
            "script-src 'self' 'unsafe-inline' 'unsafe-eval'",  # 允许同源脚本和内联脚本
            "style-src 'self' 'unsafe-inline'",  # 允许同源样式和内联样式
            "img-src 'self' data: https:",  # 允许同源图片、data URI和HTTPS图片
            "font-src 'self'",  # 允许同源字体
            "connect-src 'self'",  # 允许同源AJAX请求
            "frame-src 'none'",  # 禁止iframe
            "object-src 'none'",  # 禁止object、embed、applet
        ]
        
        # 根据环境调整策略
        if settings.DEBUG:
            # 开发环境下可能需要更宽松的策略
            policies[1] = "script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:*"
            policies[2] = "style-src 'self' 'unsafe-inline' http://localhost:*"
        
        return '; '.join(policies)

# 更严格的内容安全策略
class StrictContentSecurityPolicyMiddleware(MiddlewareMixin):
    """严格的CSP中间件"""
    
    def process_response(self, request, response):
        if response.get('Content-Type', '').startswith('text/html'):
            # 使用nonce-based策略
            import secrets
            nonce = secrets.token_urlsafe(16)
            
            policies = [
                f"script-src 'nonce-{nonce}' 'strict-dynamic'",
                f"style-src 'nonce-{nonce}'",
                "default-src 'self'",
                "img-src 'self' data:",
                "font-src 'self'",
                "connect-src 'self'",
                "frame-ancestors 'none'",  # 防止点击劫持
            ]
            
            response['Content-Security-Policy'] = '; '.join(policies)
            request.csp_nonce = nonce  # 将nonce存储在request中
        
        return response

# CSP上下文处理器
def csp_context_processor(request):
    """CSP上下文处理器"""
    nonce = getattr(request, 'csp_nonce', '')
    return {
        'csp_nonce': nonce
    }

"""
在模板中使用CSP nonce：

<script nonce="{{ csp_nonce }}">
    // 只有使用正确nonce的脚本才能执行
</script>

<style nonce="{{ csp_nonce }}">
    /* 只有使用正确nonce的样式才能应用 */
</style>
"""

"""
CSRF (Cross-Site Request Forgery) 攻击原理：

攻击流程：
1. 用户登录受信任网站A并保持登录状态
2. 用户访问恶意网站B
3. 网站B构造针对网站A的恶意请求
4. 用户浏览器自动携带网站A的Cookie发送请求
5. 网站A验证Cookie认为请求合法，执行操作

防护机制：
- CSRF令牌验证
- SameSite Cookie属性
- Referer检查
- Origin检查
"""

# Django CSRF中间件配置和自定义
from django.middleware.csrf import CsrfViewMiddleware
from django.http import HttpResponseForbidden
import logging

logger = logging.getLogger('django.security.csrf')

class EnhancedCsrfMiddleware(CsrfViewMiddleware):
    """增强的CSRF中间件"""
    
    def process_view(self, request, callback, callback_args, callback_kwargs):
        # 检查是否跳过CSRF验证
        if getattr(callback, 'csrf_exempt', False):
            return None
        
        # 检查请求方法
        if request.method not in ('GET', 'HEAD', 'OPTIONS', 'TRACE'):
            # 对于POST、PUT、PATCH、DELETE请求进行CSRF验证
            if not self._accept(request):
                return self._reject(request, 'CSRF token missing or incorrect.')
        
        return None
    
    def _accept(self, request):
        """接受请求 - CSRF验证通过"""
        # 调用父类的验证方法
        return super()._accept(request)
    
    def _reject(self, request, reason):
        """拒绝请求 - CSRF验证失败"""
        logger.warning(
            'Forbidden (%s): %s', reason, request.path,
            extra={
                'status_code': 403,
                'request': request,
            }
        )
        
        # 返回更友好的错误页面
        from django.shortcuts import render
        return render(request, 'csrf_error.html', {
            'error_message': '请求验证失败，请刷新页面重试',
            'reason': reason
        }, status=403)

# 自定义CSRF验证函数
def custom_csrf_protect(view_func):
    """自定义CSRF保护装饰器"""
    from functools import wraps
    from django.middleware.csrf import get_token
    from django.http import HttpResponseForbidden
    
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        if request.method in ['POST', 'PUT', 'PATCH', 'DELETE']:
            # 检查CSRF令牌
            csrf_token = request.META.get('HTTP_X_CSRFTOKEN') or \
                        request.POST.get('csrfmiddlewaretoken') or \
                        request.META.get('CSRF_COOKIE')
            
            if not csrf_token:
                return HttpResponseForbidden('CSRF token missing')
            
            # 验证令牌
            from django.middleware.csrf import _compare_salted_tokens
            if not _compare_salted_tokens(csrf_token, get_token(request)):
                return HttpResponseForbidden('CSRF token invalid')
        
        return view_func(request, *args, **kwargs)
    
    return wrapper

# CSRF安全的AJAX请求
from django.views.decorators.csrf import csrf_protect, csrf_exempt
from django.utils.decorators import method_decorator
from django.views import View
import json

@method_decorator(csrf_protect, name='dispatch')
class SecureAPIView(View):
    """安全的API视图"""
    
    def post(self, request):
        try:
            data = json.loads(request.body)
            # 处理POST数据
            result = self.process_data(data)
            return JsonResponse({'success': True, 'data': result})
        except json.JSONDecodeError:
            return JsonResponse({'error': 'Invalid JSON'}, status=400)
        except Exception as e:
            return JsonResponse({'error': str(e)}, status=500)
    
    def process_data(self, data):
        """处理数据的具体逻辑"""
        # 实现具体的业务逻辑
        return {'processed': True}

# 在模板中获取CSRF令牌用于AJAX请求
def get_csrf_token(request):
    """获取CSRF令牌的视图"""
    from django.middleware.csrf import get_token
    from django.http import JsonResponse
    
    return JsonResponse({
        'csrf_token': get_token(request)
    })

"""
前端JavaScript中使用CSRF令牌：

// 方法1：从隐藏表单字段获取
function getCSRFToken() {
    return document.querySelector('[name=csrfmiddlewaretoken]').value;
}

// 方法2：从Cookie获取
function getCSRFTokenFromCookie() {
    let name = 'csrftoken';
    let cookieValue = null;
    if (document.cookie && document.cookie !== '') {
        const cookies = document.cookie.split(';');
        for (let i = 0; i < cookies.length; i++) {
            const cookie = cookies[i].trim();
            if (cookie.substring(0, name.length + 1) === (name + '=')) {
                cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
                break;
            }
        }
    }
    return cookieValue;
}

// 在AJAX请求中使用CSRF令牌
$.ajaxSetup({
    beforeSend: function(xhr, settings) {
        if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
            xhr.setRequestHeader("X-CSRFToken", getCSRFTokenFromCookie());
        }
    }
});
"""

# settings.py 中的CSRF安全配置
"""
# CSRF安全配置示例
CSRF_COOKIE_NAME = 'csrftoken'
CSRF_COOKIE_AGE = 31449600  # 一年
CSRF_COOKIE_DOMAIN = None
CSRF_COOKIE_HTTPONLY = False  # 需要在JavaScript中访问
CSRF_COOKIE_SECURE = True  # 仅在HTTPS下传输
CSRF_COOKIE_SAMESITE = 'Strict'  # 防止跨站请求
CSRF_TRUSTED_ORIGINS = [
    'https://yourdomain.com',
    'https://www.yourdomain.com',
]
"""

"""
SQL注入攻击原理：

攻击示例：
原始查询：SELECT * FROM users WHERE username = '$username'
恶意输入：admin'; DROP TABLE users; --
实际执行：SELECT * FROM users WHERE username = 'admin'; DROP TABLE users; --'

防护机制：
- 参数化查询
- ORM查询
- 输入验证
- 白名单过滤
"""

# Django ORM安全查询实践
from django.db import models
from django.contrib.auth.models import User
from django.core.exceptions import ValidationError
import re

class SafeQueryManager:
    """安全查询管理器"""
    
    @staticmethod
    def safe_filter_by_username(queryset, username):
        """安全的用户名过滤"""
        # 验证用户名格式
        if not re.match(r'^[a-zA-Z0-9_]{3,30}$', username):
            raise ValidationError('用户名格式不正确')
        
        # 使用ORM的安全查询
        return queryset.filter(username=username)
    
    @staticmethod
    def safe_search_users(queryset, search_term):
        """安全的用户搜索"""
        # 验证搜索词
        if len(search_term) > 100:
            raise ValidationError('搜索词过长')
        
        # 清理搜索词中的潜在危险字符
        clean_term = re.sub(r'[^\w\s\u4e00-\u9fff]', '', search_term)
        
        if not clean_term:
            return queryset.none()
        
        # 使用ORM的安全搜索
        return queryset.filter(
            models.Q(username__icontains=clean_term) |
            models.Q(first_name__icontains=clean_term) |
            models.Q(last_name__icontains=clean_term) |
            models.Q(email__icontains=clean_term)
        )
    
    @staticmethod
    def safe_order_by(queryset, field, allowed_fields=None):
        """安全的排序"""
        if allowed_fields is None:
            allowed_fields = ['id', 'username', 'email', 'date_joined', 'last_login']
        
        if field.lstrip('-') not in allowed_fields:
            raise ValidationError('不允许的排序字段')
        
        return queryset.order_by(field)
    
    @staticmethod
    def safe_pagination(queryset, page=1, page_size=20):
        """安全的分页"""
        page = max(1, int(page))
        page_size = min(100, max(1, int(page_size)))  # 限制最大页面大小
        
        offset = (page - 1) * page_size
        limit = page_size
        
        return queryset[offset:offset + limit]

# 安全的用户查询视图
from django.shortcuts import render, get_object_or_404
from django.http import JsonResponse
from django.core.paginator import Paginator
from django.db.models import Q

def secure_user_search(request):
    """安全的用户搜索视图"""
    search_term = request.GET.get('q', '').strip()
    page = int(request.GET.get('page', 1))
    order_by = request.GET.get('order_by', 'username')
    
    try:
        # 构建安全的查询
        queryset = User.objects.all()
        
        if search_term:
            # 使用安全的搜索方法
            queryset = SafeQueryManager.safe_search_users(queryset, search_term)
        
        # 安全排序
        allowed_fields = ['username', 'email', 'date_joined', 'last_login']
        queryset = SafeQueryManager.safe_order_by(queryset, order_by, allowed_fields)
        
        # 分页
        paginator = Paginator(queryset, 20)
        users = paginator.get_page(page)
        
        context = {
            'users': users,
            'search_term': search_term,
            'order_by': order_by,
        }
        
        return render(request, 'secure_user_search.html', context)
    
    except ValidationError as e:
        return JsonResponse({'error': str(e)}, status=400)
    except Exception as e:
        return JsonResponse({'error': '搜索失败'}, status=500)

# 自定义查询方法
class SecureUserQuerySet(models.QuerySet):
    """安全的用户查询集"""
    
    def by_username_pattern(self, pattern):
        """按用户名模式查询（安全）"""
        # 使用数据库的LIKE操作，但要防止通配符注入
        safe_pattern = pattern.replace('%', r'\%').replace('_', r'\_')
        return self.filter(username__contains=safe_pattern)
    
    def by_email_domain(self, domain):
        """按邮箱域名查询（安全）"""
        if not re.match(r'^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$', domain):
            raise ValidationError('域名格式不正确')
        
        return self.filter(email__endswith=f'@{domain}')
    
    def active_in_date_range(self, start_date, end_date):
        """按日期范围查询活跃用户（安全）"""
        from django.utils import timezone
        from datetime import datetime
        
        if not isinstance(start_date, datetime) or not isinstance(end_date, datetime):
            raise ValidationError('日期格式不正确')
        
        if start_date > end_date:
            raise ValidationError('开始日期不能晚于结束日期')
        
        return self.filter(
            last_login__range=[start_date, end_date],
            is_active=True
        )

# 安全的用户模型
class SecureUserManager(models.Manager):
    """安全的用户管理器"""
    
    def get_queryset(self):
        return SecureUserQuerySet(self.model, using=self._db)
    
    def safe_get_by_username(self, username):
        """安全获取用户（按用户名）"""
        if not re.match(r'^[a-zA-Z0-9_]{3,30}$', username):
            raise ValidationError('用户名格式不正确')
        
        return self.get(username=username)
    
    def safe_get_by_email(self, email):
        """安全获取用户（按邮箱）"""
        from django.core.validators import validate_email
        validate_email(email)
        
        return self.get(email=email.lower())

"""
使用示例：

# 在models.py中
class User(AbstractUser):
    objects = SecureUserManager()
    
    def save(self, *args, **kwargs):
        # 确保邮箱小写存储
        if self.email:
            self.email = self.email.lower()
        super().save(*args, **kwargs)

# 在views.py中
def user_detail(request, username):
    try:
        # 使用安全的方法获取用户
        user = User.objects.safe_get_by_username(username)
        return render(request, 'user_detail.html', {'user': user})
    except ValidationError:
        return render(request, 'error.html', {'message': '用户名格式错误'})
    except User.DoesNotExist:
        return render(request, 'error.html', {'message': '用户不存在'})
"""

# 原生SQL查询安全实践
from django.db import connection, transaction
from django.core.exceptions import ValidationError
import re

class SafeRawQuery:
    """安全的原生查询"""
    
    @staticmethod
    def safe_raw_select(table, columns, conditions=None, params=None):
        """安全的原生SELECT查询"""
        # 验证表名
        if not re.match(r'^[a-zA-Z_][a-zA-Z0-9_]*$', table):
            raise ValidationError('表名格式不正确')
        
        # 验证列名
        for col in columns:
            if not re.match(r'^[a-zA-Z_][a-zA-Z0-9_]*$', col):
                raise ValidationError(f'列名格式不正确: {col}')
        
        # 构建查询
        query = f"SELECT {', '.join(columns)} FROM {table}"
        
        if conditions:
            query += f" WHERE {conditions}"
        
        # 使用参数化查询
        with connection.cursor() as cursor:
            cursor.execute(query, params or [])
            return cursor.fetchall()
    
    @staticmethod
    def safe_parameterized_query(sql_template, params):
        """安全的参数化查询"""
        # 验证SQL模板中不包含危险操作
        dangerous_keywords = ['DROP', 'DELETE', 'UPDATE', 'INSERT', 'CREATE', 'ALTER', 'EXEC']
        
        sql_upper = sql_template.upper()
        for keyword in dangerous_keywords:
            if keyword in sql_upper:
                raise ValidationError(f'SQL模板包含危险关键字: {keyword}')
        
        # 确保参数是安全的数据类型
        safe_types = (str, int, float, bool, type(None))
        for param in params:
            if not isinstance(param, safe_types):
                raise ValidationError(f'参数类型不安全: {type(param)}')
        
        with connection.cursor() as cursor:
            cursor.execute(sql_template, params)
            return cursor.fetchall()
    
    @staticmethod
    def safe_bulk_insert(table, columns, data_rows):
        """安全的批量插入"""
        # 验证表名和列名
        if not re.match(r'^[a-zA-Z_][a-zA-Z0-9_]*$', table):
            raise ValidationError('表名格式不正确')
        
        for col in columns:
            if not re.match(r'^[a-zA-Z_][a-zA-Z0-9_]*$', col):
                raise ValidationError(f'列名格式不正确: {col}')
        
        # 验证数据行格式
        expected_columns = len(columns)
        for row in data_rows:
            if len(row) != expected_columns:
                raise ValidationError('数据行列数不匹配')
        
        # 构建安全的批量插入查询
        placeholders = ', '.join(['%s'] * len(columns))
        query = f"INSERT INTO {table} ({', '.join(columns)}) VALUES ({placeholders})"
        
        with transaction.atomic():  # 使用事务确保数据一致性
            with connection.cursor() as cursor:
                cursor.executemany(query, data_rows)

# 使用示例
def secure_data_operations(request):
    """安全的数据操作示例"""
    try:
        # 安全的查询
        results = SafeRawQuery.safe_raw_select(
            table='auth_user',
            columns=['id', 'username', 'email'],
            conditions='is_active = %s AND date_joined > %s',
            params=[True, '2024-01-01']
        )
        
        # 安全的批量插入
        new_users_data = [
            ('user1', 'user1@example.com'),
            ('user2', 'user2@example.com'),
        ]
        
        SafeRawQuery.safe_bulk_insert(
            table='auth_user',
            columns=['username', 'email'],
            data_rows=new_users_data
        )
        
        return JsonResponse({
            'success': True,
            'results': results
        })
        
    except ValidationError as e:
        return JsonResponse({'error': str(e)}, status=400)
    except Exception as e:
        return JsonResponse({'error': '操作失败'}, status=500)

# 点击劫持防护
from django.utils.deprecation import MiddlewareMixin
from django.http import HttpResponse

class XFrameOptionsMiddleware(MiddlewareMixin):
    """X-Frame-Options中间件"""
    
    def process_response(self, request, response):
        # 为所有响应添加X-Frame-Options头
        if not response.get('X-Frame-Options'):
            # DENY: 不允许在任何frame中显示
            # SAMEORIGIN: 只允许同源frame中显示
            # ALLOW-FROM uri: 允许指定来源显示
            response['X-Frame-Options'] = 'DENY'
        
        return response

# 点击劫持防护装饰器
from functools import wraps

def xframe_options_deny(view_func):
    """X-Frame-Options: DENY 装饰器"""
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        response = view_func(request, *args, **kwargs)
        response['X-Frame-Options'] = 'DENY'
        return response
    return wrapper

def xframe_options_sameorigin(view_func):
    """X-Frame-Options: SAMEORIGIN 装饰器"""
    @wraps(view_func)
    def wrapper(request, *args, **kwargs):
        response = view_func(request, *args, **kwargs)
        response['X-Frame-Options'] = 'SAMEORIGIN'
        return response
    return wrapper

# 在敏感页面使用点击劫持防护
@xframe_options_deny
def sensitive_page(request):
    """敏感页面 - 不允许在iframe中显示"""
    return render(request, 'sensitive_page.html')

# Django内置的点击劫持防护
from django.views.decorators.clickjacking import xframe_options_exempt, xframe_options_sameorigin

@xframe_options_exempt  # 允许在iframe中显示
def embeddable_page(request):
    return render(request, 'embeddable_page.html')

# HTTP安全头中间件
class SecurityHeadersMiddleware(MiddlewareMixin):
    """安全头中间件"""
    
    def process_response(self, request, response):
        # X-Content-Type-Options: 防止MIME类型嗅探
        response['X-Content-Type-Options'] = 'nosniff'
        
        # X-XSS-Protection: 启用浏览器XSS过滤
        response['X-XSS-Protection'] = '1; mode=block'
        
        # Referrer-Policy: 控制Referer头的发送
        response['Referrer-Policy'] = 'strict-origin-when-cross-origin'
        
        # Strict-Transport-Security: 强制HTTPS
        if request.is_secure():
            response['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
        
        # Feature-Policy: 控制浏览器功能访问
        response['Feature-Policy'] = (
            "geolocation 'none'; "
            "camera 'none'; "
            "microphone 'none'; "
            "payment 'none'"
        )
        
        return response

# 安全头配置示例
"""
# settings.py 中的安全头配置
SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_SECONDS = 31536000
SECURE_REDIRECT_EXEMPT = []
SECURE_REFERRER_POLICY = 'same-origin'
SECURE_SSL_HOST = None
SECURE_SSL_REDIRECT = True
"""

# 安全的文件上传处理
import os
import magic
from django.core.files.storage import default_storage
from django.core.exceptions import ValidationError
from django.conf import settings
import hashlib

class SecureFileUpload:
    """安全文件上传处理器"""
    
    # 允许的文件类型
    ALLOWED_MIME_TYPES = {
        'image/jpeg',
        'image/png',
        'image/gif',
        'image/webp',
        'application/pdf',
        'text/plain',
        'application/msword',
        'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
    }
    
    # 文件扩展名映射
    MIME_TYPE_EXTENSIONS = {
        'image/jpeg': ['.jpg', '.jpeg'],
        'image/png': ['.png'],
        'image/gif': ['.gif'],
        'image/webp': ['.webp'],
        'application/pdf': ['.pdf'],
        'text/plain': ['.txt'],
        'application/msword': ['.doc'],
        'application/vnd.openxmlformats-officedocument.wordprocessingml.document': ['.docx'],
    }
    
    MAX_FILE_SIZE = 10 * 1024 * 1024  # 10MB
    
    @classmethod
    def validate_file(cls, uploaded_file):
        """验证上传的文件"""
        # 检查文件大小
        if uploaded_file.size > cls.MAX_FILE_SIZE:
            raise ValidationError(f'文件大小不能超过 {cls.MAX_FILE_SIZE // (1024*1024)}MB')
        
        # 检查文件扩展名
        _, ext = os.path.splitext(uploaded_file.name.lower())
        if not cls.is_allowed_extension(ext):
            raise ValidationError(f'不允许的文件类型: {ext}')
        
        # 检查MIME类型
        mime_type = cls.get_mime_type(uploaded_file)
        if mime_type not in cls.ALLOWED_MIME_TYPES:
            raise ValidationError(f'不允许的MIME类型: {mime_type}')
        
        # 额外的安全检查
        cls.perform_security_checks(uploaded_file)
        
        return True
    
    @classmethod
    def is_allowed_extension(cls, extension):
        """检查扩展名是否允许"""
        allowed_extensions = set()
        for extensions in cls.MIME_TYPE_EXTENSIONS.values():
            allowed_extensions.update(extensions)
        
        return extension in allowed_extensions
    
    @classmethod
    def get_mime_type(cls, uploaded_file):
        """获取文件的真实MIME类型"""
        # 使用python-magic库检测真实MIME类型
        # 注意：需要安装 python-magic: pip install python-magic
        try:
            mime = magic.Magic(mime=True)
            # 读取文件前几个字节来检测类型
            uploaded_file.seek(0)
            file_content = uploaded_file.read(1024)  # 读取前1024字节
            mime_type = mime.from_buffer(file_content)
            uploaded_file.seek(0)  # 重置文件指针
            return mime_type
        except ImportError:
            # 如果没有magic库，使用文件扩展名判断
            _, ext = os.path.splitext(uploaded_file.name.lower())
            # 简单的扩展名到MIME类型的映射
            ext_to_mime = {
                '.jpg': 'image/jpeg',
                '.jpeg': 'image/jpeg',
                '.png': 'image/png',
                '.gif': 'image/gif',
                '.webp': 'image/webp',
                '.pdf': 'application/pdf',
                '.txt': 'text/plain',
                '.doc': 'application/msword',
                '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
            }
            return ext_to_mime.get(ext, 'application/octet-stream')
    
    @classmethod
    def perform_security_checks(cls, uploaded_file):
        """执行安全检查"""
        # 检查是否为图片文件，防止图片漏洞
        mime_type = cls.get_mime_type(uploaded_file)
        if mime_type.startswith('image/'):
            cls.check_image_security(uploaded_file)
    
    @classmethod
    def check_image_security(cls, image_file):
        """检查图片安全性"""
        try:
            from PIL import Image
            # 尝试打开图片，这会检测基本的图片损坏
            image_file.seek(0)
            img = Image.open(image_file)
            img.verify()  # 验证图片完整性
            image_file.seek(0)  # 重置文件指针
        except Exception as e:
            raise ValidationError(f'图片文件可能不安全: {str(e)}')
    
    @classmethod
    def save_secure_file(cls, uploaded_file, upload_dir='uploads/'):
        """安全保存文件"""
        # 验证文件
        cls.validate_file(uploaded_file)
        
        # 生成安全的文件名
        safe_filename = cls.generate_safe_filename(uploaded_file.name)
        
        # 构建完整路径
        full_path = os.path.join(upload_dir, safe_filename)
        
        # 保存文件
        saved_path = default_storage.save(full_path, uploaded_file)
        
        return saved_path
    
    @classmethod
    def generate_safe_filename(cls, original_filename):
        """生成安全的文件名"""
        # 获取文件扩展名
        _, ext = os.path.splitext(original_filename)
        
        # 生成基于内容的哈希文件名
        content_hash = hashlib.sha256(original_filename.encode()).hexdigest()[:12]
        
        # 组合安全文件名
        safe_name = f"{content_hash}{ext.lower()}"
        
        return safe_name

# 安全文件上传视图
from django.shortcuts import render
from django.http import JsonResponse

def secure_file_upload_view(request):
    """安全文件上传视图"""
    if request.method == 'POST' and request.FILES.get('file'):
        uploaded_file = request.FILES['file']
        
        try:
            # 使用安全的文件上传处理器
            saved_path = SecureFileUpload.save_secure_file(uploaded_file)
            
            return JsonResponse({
                'success': True,
                'file_path': saved_path,
                'file_size': uploaded_file.size,
                'mime_type': SecureFileUpload.get_mime_type(uploaded_file)
            })
        
        except ValidationError as e:
            return JsonResponse({
                'success': False,
                'error': str(e)
            }, status=400)
        
        except Exception as e:
            return JsonResponse({
                'success': False,
                'error': '文件上传失败'
            }, status=500)
    
    return render(request, 'secure_upload_form.html')

# 安全的文件上传表单验证
from django import forms

class SecureFileUploadForm(forms.Form):
    """安全的文件上传表单"""
    file = forms.FileField()
    
    def clean_file(self):
        """验证上传的文件"""
        uploaded_file = self.cleaned_data.get('file')
        
        if uploaded_file:
            # 使用安全验证
            try:
                SecureFileUpload.validate_file(uploaded_file)
            except ValidationError as e:
                raise forms.ValidationError(str(e))
        
        return uploaded_file

# 安全配置最佳实践
"""
# settings.py 安全配置示例

import os
from pathlib import Path

BASE_DIR = Path(__file__).resolve().parent.parent

# 安全密钥（生产环境中应从环境变量获取）
SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY', 'your-secret-key-here')

# 调试模式（生产环境中必须设置为False）
DEBUG = os.environ.get('DJANGO_DEBUG', 'False').lower() == 'true'

# 允许的主机
ALLOWED_HOSTS = [
    'yourdomain.com',
    'www.yourdomain.com',
    'localhost',
    '127.0.0.1',
]

# 安全相关的设置
SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
SECURE_HSTS_SECONDS = 31536000  # 一年
SECURE_REDIRECT_EXEMPT = []
SECURE_REFERRER_POLICY = 'strict-origin-when-cross-origin'
SECURE_SSL_HOST = None
SECURE_SSL_REDIRECT = True

# 会话安全设置
SESSION_COOKIE_AGE = 1209600  # 2周
SESSION_COOKIE_DOMAIN = None
SESSION_COOKIE_HTTPONLY = True  # 防止JavaScript访问
SESSION_COOKIE_NAME = 'sessionid'
SESSION_COOKIE_PATH = '/'
SESSION_COOKIE_SECURE = True  # 仅HTTPS传输
SESSION_COOKIE_SAMESITE = 'Strict'  # 防止CSRF
SESSION_EXPIRE_AT_BROWSER_CLOSE = False
SESSION_SAVE_EVERY_REQUEST = False

# CSRF安全设置
CSRF_COOKIE_AGE = 31449600  # 一年
CSRF_COOKIE_DOMAIN = None
CSRF_COOKIE_HTTPONLY = False  # JavaScript需要访问
CSRF_COOKIE_NAME = 'csrftoken'
CSRF_COOKIE_PATH = '/'
CSRF_COOKIE_SECURE = True  # 仅HTTPS传输
CSRF_COOKIE_SAMESITE = 'Strict'  # 防止CSRF
CSRF_TRUSTED_ORIGINS = [
    'https://yourdomain.com',
    'https://www.yourdomain.com',
]

# 密码验证器
AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
        'OPTIONS': {
            'min_length': 12,
        }
    },
    {
        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
    },
]
"""

# 环境配置管理
import os
from decouple import config  # pip install python-decouple
from django.core.management.utils import get_random_secret_key

class SecurityConfig:
    """安全配置类"""
    
    # 基础安全设置
    SECRET_KEY = config('SECRET_KEY', default=get_random_secret_key())
    DEBUG = config('DEBUG', default=False, cast=bool)
    
    # 数据库安全
    DATABASES = {
        'default': {
            'ENGINE': 'django.db.backends.postgresql',
            'NAME': config('DB_NAME', default='myproject'),
            'USER': config('DB_USER', default='myprojectuser'),
            'PASSWORD': config('DB_PASSWORD', default=''),
            'HOST': config('DB_HOST', default='localhost'),
            'PORT': config('DB_PORT', default='5432'),
        }
    }
    
    # 安全头设置
    SECURE_SSL_REDIRECT = config('SECURE_SSL_REDIRECT', default=True, cast=bool)
    SECURE_HSTS_SECONDS = config('SECURE_HSTS_SECONDS', default=31536000, cast=int)
    SECURE_HSTS_INCLUDE_SUBDOMAINS = True
    SECURE_HSTS_PRELOAD = True
    SECURE_CONTENT_TYPE_NOSNIFF = True
    SECURE_BROWSER_XSS_FILTER = True
    
    # 会话设置
    SESSION_COOKIE_SECURE = config('SESSION_COOKIE_SECURE', default=True, cast=bool)
    SESSION_COOKIE_HTTPONLY = True
    SESSION_COOKIE_SAMESITE = 'Strict'
    
    # CSRF设置
    CSRF_COOKIE_SECURE = config('CSRF_COOKIE_SECURE', default=True, cast=bool)
    CSRF_COOKIE_HTTPONLY = False
    CSRF_COOKIE_SAMESITE = 'Strict'

# 环境特定配置
class DevelopmentConfig(SecurityConfig):
    """开发环境配置"""
    DEBUG = True
    ALLOWED_HOSTS = ['localhost', '127.0.0.1', '[::1]']
    SECURE_SSL_REDIRECT = False
    SESSION_COOKIE_SECURE = False
    CSRF_COOKIE_SECURE = False

class ProductionConfig(SecurityConfig):
    """生产环境配置"""
    DEBUG = False
    ALLOWED_HOSTS = [
        'yourdomain.com',
        'www.yourdomain.com',
    ]
    
    # 生产环境额外安全措施
    SECURE_SSL_REDIRECT = True
    SECURE_HSTS_SECONDS = 31536000
    SECURE_HSTS_INCLUDE_SUBDOMAINS = True
    SECURE_CONTENT_TYPE_NOSNIFF = True
    SECURE_BROWSER_XSS_FILTER = True
    
    # 日志配置
    LOGGING = {
        'version': 1,
        'disable_existing_loggers': False,
        'formatters': {
            'verbose': {
                'format': '{levelname} {asctime} {module} {process:d} {thread:d} {message}',
                'style': '{',
            },
        },
        'handlers': {
            'file': {
                'level': 'INFO',
                'class': 'logging.FileHandler',
                'filename': '/var/log/django/security.log',
                'formatter': 'verbose',
            },
        },
        'loggers': {
            'django.security': {
                'handlers': ['file'],
                'level': 'INFO',
                'propagate': True,
            },
        },
    }

# 根据环境选择配置
ENVIRONMENT = os.environ.get('DJANGO_ENV', 'development')

if ENVIRONMENT == 'production':
    # 生产环境配置
    pass  # 在settings.py中导入ProductionConfig
elif ENVIRONMENT == 'development':
    # 开发环境配置
    pass  # 在settings.py中导入DevelopmentConfig

# 安全测试实践
from django.test import TestCase, Client
from django.contrib.auth.models import User
from django.urls import reverse
import json

class SecurityTestCase(TestCase):
    """安全测试用例"""
    
    def setUp(self):
        """测试准备"""
        self.client = Client()
        self.user = User.objects.create_user(
            username='testuser',
            email='test@example.com',
            password='securepassword123!'
        )
        self.admin_user = User.objects.create_superuser(
            username='admin',
            email='admin@example.com',
            password='adminpassword123!'
        )
    
    def test_csrf_protection(self):
        """测试CSRF保护"""
        # 无CSRF令牌的POST请求应该失败
        response = self.client.post('/some-form/', {
            'data': 'test'
        })
        self.assertEqual(response.status_code, 403)  # CSRF验证失败
    
    def test_xss_protection(self):
        """测试XSS保护"""
        # 尝试注入脚本
        malicious_script = '<script>alert("XSS")</script>'
        
        response = self.client.get(f'/search/?q={malicious_script}')
        
        # 响应中不应该包含原始脚本（应该被转义）
        self.assertNotContains(response, '<script>', status_code=200)
        self.assertContains(response, '<script>', status_code=200)
    
    def test_sql_injection_attempts(self):
        """测试SQL注入防护"""
        # 常见的SQL注入尝试
        injection_attempts = [
            "' OR '1'='1",
            "'; DROP TABLE users; --",
            "' UNION SELECT * FROM users --",
            "admin'; WAITFOR DELAY '00:00:05' --",
        ]
        
        for attempt in injection_attempts:
            with self.assertRaises(Exception):  # 或者期望的异常类型
                # 这里应该测试实际的查询逻辑
                pass
    
    def test_authentication_required(self):
        """测试认证保护"""
        # 未认证用户访问受保护页面
        response = self.client.get('/admin/')
        self.assertRedirects(response, '/accounts/login/')
        
        # 认证后可以访问
        self.client.login(username='admin', password='adminpassword123!')
        response = self.client.get('/admin/')
        self.assertEqual(response.status_code, 200)
    
    def test_authorization_required(self):
        """测试授权保护"""
        # 普通用户不能访问管理员页面
        self.client.login(username='testuser', password='securepassword123!')
        response = self.client.get('/admin/')
        self.assertEqual(response.status_code, 403)  # 禁止访问
    
    def test_file_upload_security(self):
        """测试文件上传安全"""
        # 尝试上传恶意文件
        import tempfile
        from django.core.files.uploadedfile import SimpleUploadedFile
        
        # 创建一个伪装成图片的PHP文件
        malicious_file = SimpleUploadedFile(
            "test.php",
            b"<?php echo 'malicious code'; ?>",
            content_type="image/jpeg"
        )
        
        response = self.client.post('/upload/', {
            'file': malicious_file
        })
        
        # 应该被拒绝
        self.assertEqual(response.status_code, 400)
    
    def test_rate_limiting(self):
        """测试速率限制"""
        # 快速发送多个请求来测试速率限制
        for i in range(20):  # 假设限制是10次请求
            response = self.client.post('/api/endpoint/', {
                'data': f'test_data_{i}'
            })
            
            if i > 10:  # 超过限制后应该被拒绝
                self.assertIn(response.status_code, [429, 403])

# 安全扫描工具集成
"""
# 使用bandit进行静态代码分析
pip install bandit
bandit -r .

# 使用djangosecure进行安全检查
pip install djangosecure
python manage.py check --deploy

# 使用Safety检查依赖包安全
pip install safety
safety check
"""

# 安全监控实现
import logging
from django.http import HttpRequest
from django.core.handlers.wsgi import WSGIRequest
from django.contrib.auth.signals import user_logged_in, user_logged_out, user_login_failed
from django.dispatch import receiver
from django.db.models.signals import pre_save, post_save
from django.contrib.auth.models import User
import time
from collections import defaultdict, deque
from datetime import datetime, timedelta

# 安全日志配置
SECURITY_LOGGER = logging.getLogger('security')

class SecurityMonitor:
    """安全监控器"""
    
    def __init__(self):
        self.failed_login_attempts = defaultdict(deque)
        self.rate_limit_windows = defaultdict(deque)
        self.security_events = []
    
    def log_security_event(self, event_type, user=None, ip_address=None, details=None):
        """记录安全事件"""
        event = {
            'timestamp': datetime.now(),
            'event_type': event_type,
            'user': user.username if user else 'Anonymous',
            'ip_address': ip_address,
            'details': details or {}
        }
        
        SECURITY_LOGGER.info(f"SECURITY EVENT: {event}")
        self.security_events.append(event)
        
        # 实时告警
        self.check_security_thresholds(event)
    
    def check_security_thresholds(self, event):
        """检查安全阈值"""
        if event['event_type'] == 'failed_login':
            # 检查失败登录尝试
            self.check_failed_login_threshold(event)
        elif event['event_type'] == 'rate_limit_exceeded':
            # 检查速率限制
            self.check_rate_limit_threshold(event)
    
    def check_failed_login_threshold(self, event):
        """检查失败登录阈值"""
        ip = event['ip_address']
        window_start = datetime.now() - timedelta(minutes=15)
        
        # 获取15分钟内的失败尝试
        recent_attempts = [
            e for e in self.failed_login_attempts[ip]
            if e > window_start
        ]
        
        if len(recent_attempts) >= 5:
            # 可能的暴力破解攻击
            self.trigger_security_alert(
                'BRUTE_FORCE_ATTACK_DETECTED',
                f"Multiple failed login attempts from IP: {ip}"
            )
    
    def trigger_security_alert(self, alert_type, message):
        """触发安全告警"""
        SECURITY_LOGGER.critical(f"SECURITY ALERT [{alert_type}]: {message}")
        
        # 这里可以集成邮件告警、Slack通知等
        # send_security_alert(alert_type, message)

# 信号处理器
@receiver(user_login_failed)
def handle_failed_login(sender, credentials, request, **kwargs):
    """处理登录失败"""
    monitor = SecurityMonitor()
    ip_address = get_client_ip(request)
    
    monitor.log_security_event(
        event_type='failed_login',
        ip_address=ip_address,
        details={
            'username': credentials.get('username', ''),
            'user_agent': request.META.get('HTTP_USER_AGENT', '')
        }
    )

@receiver(user_logged_in)
def handle_successful_login(sender, request, user, **kwargs):
    """处理成功登录"""
    monitor = SecurityMonitor()
    ip_address = get_client_ip(request)
    
    monitor.log_security_event(
        event_type='successful_login',
        user=user,
        ip_address=ip_address,
        details={
            'user_agent': request.META.get('HTTP_USER_AGENT', '')
        }
    )

@receiver(user_logged_out)
def handle_logout(sender, request, user, **kwargs):
    """处理登出"""
    monitor = SecurityMonitor()
    ip_address = get_client_ip(request)
    
    monitor.log_security_event(
        event_type='logout',
        user=user,
        ip_address=ip_address
    )

def get_client_ip(request):
    """获取客户端IP地址"""
    x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
    if x_forwarded_for:
        ip = x_forwarded_for.split(',')[0]
    else:
        ip = request.META.get('REMOTE_ADDR')
    return ip

# 速率限制装饰器
def rate_limit(max_requests=10, window_seconds=60):
    """速率限制装饰器"""
    def decorator(view_func):
        from functools import wraps
        
        @wraps(view_func)
        def wrapper(request, *args, **kwargs):
            monitor = SecurityMonitor()
            ip_address = get_client_ip(request)
            
            now = datetime.now()
            window_start = now - timedelta(seconds=window_seconds)
            
            # 获取时间窗口内的请求
            if ip_address not in monitor.rate_limit_windows:
                monitor.rate_limit_windows[ip_address] = deque()
            
            requests_in_window = monitor.rate_limit_windows[ip_address]
            
            # 清理过期的请求记录
            while requests_in_window and requests_in_window[0] < window_start:
                requests_in_window.popleft()
            
            if len(requests_in_window) >= max_requests:
                # 触发速率限制事件
                monitor.log_security_event(
                    event_type='rate_limit_exceeded',
                    ip_address=ip_address,
                    details={
                        'max_requests': max_requests,
                        'window_seconds': window_seconds,
                        'current_requests': len(requests_in_window)
                    }
                )
                
                from django.http import HttpResponse
                return HttpResponse('Rate limit exceeded', status=429)
            
            # 记录当前请求
            requests_in_window.append(now)
            
            return view_func(request, *args, **kwargs)
        
        return wrapper
    return decorator

# 使用示例
@rate_limit(max_requests=10, window_seconds=60)
def api_endpoint(request):
    """受速率限制保护的API端点"""
    return JsonResponse({'message': 'Success'})

# 安全监控中间件
class SecurityMonitoringMiddleware:
    """安全监控中间件"""
    
    def __init__(self, get_response):
        self.get_response = get_response
        self.monitor = SecurityMonitor()

    def __call__(self, request):
        start_time = time.time()
        
        response = self.get_response(request)
        
        # 记录请求处理时间
        duration = time.time() - start_time
        
        # 监控异常请求
        if response.status_code >= 400:
            self.monitor.log_security_event(
                event_type='error_response',
                ip_address=get_client_ip(request),
                details={
                    'status_code': response.status_code,
                    'path': request.path,
                    'method': request.method,
                    'duration': duration
                }
            )
        
        return response
    
    def process_exception(self, request, exception):
        """处理异常"""
        self.monitor.log_security_event(
            event_type='exception_occurred',
            ip_address=get_client_ip(request),
            details={
                'exception': str(exception),
                'path': request.path,
                'method': request.method,
                'exception_type': type(exception).__name__
            }
        )

"""
安全监控配置示例：

# settings.py
LOGGING = {
    'version': 1,
    'disable_existing_loggers': False,
    'formatters': {
        'security': {
            'format': '%(asctime)s [SECURITY] %(message)s',
            'datefmt': '%Y-%m-%d %H:%M:%S',
        },
    },
    'handlers': {
        'security_file': {
            'level': 'INFO',
            'class': 'logging.handlers.RotatingFileHandler',
            'filename': '/var/log/django/security.log',
            'maxBytes': 1024*1024*10,  # 10MB
            'backupCount': 5,
            'formatter': 'security',
        },
        'security_alert': {
            'level': 'CRITICAL',
            'class': 'logging.handlers.SMTPHandler',
            'mailhost': ('smtp.gmail.com', 587),
            'fromaddr': 'security@yourdomain.com',
            'toaddrs': ['admin@yourdomain.com'],
            'subject': 'Security Alert from Django Application',
            'credentials': ('username', 'password'),
            'formatter': 'security',
        },
    },
    'loggers': {
        'security': {
            'handlers': ['security_file', 'security_alert'],
            'level': 'INFO',
            'propagate': False,
        },
    },
}
"""

"""
本章核心要点：

1. 安全是Web应用开发的基石，需要从设计阶段就考虑
2. Django提供了强大的内置安全机制，但需要正确配置和使用
3. 深度防御策略是最有效的安全防护方式
4. 输入验证和输出编码是防止注入攻击的关键
5. 安全配置应根据环境进行差异化设置
6. 持续的安全监控和测试是保障应用安全的重要手段
7. 遵循安全开发生命周期(SDL)有助于构建更安全的应用
8. 定期进行安全审计和渗透测试是必要的安全措施
"""