Django 管理员 - 重新身份验证？
我现在对于 Django 的管理后端有点进退两难。默认身份验证系统允许已登录的具有员工权限的用户访问管理站点，但它只是让他们直接进入。
这对我来说感觉不太“正确”，我想知道这是否会很难至少需要对同一会话重新进行身份验证才能进入后端。
不过，如果前端会话可以与后端会话分开（尽管仍然使用相同的用户对象），那就更好了，这将允许站点的两个部分完全分离。这可能需要两个单独的身份验证后端吗？这样的事情会很难实现吗？
I'm in a bit of a dilemma at the moment regarding Django's admin backend. The default authentication system allows already logged-in users that have staff privileges to access the admin site, however it just lets them straight in.
This doesn't feel “right” to me, and I'm wondering if it would be difficult to at least require a re-authentication of that same session in order to get into the backend.
Preferably though, it'd be good if the frontend sessions could be separated from the backend ones (though still using the same user objects), this would allow a clean separation of both parts of the site. Would this perhaps require two separate authentication backends? Would something like this be difficult to achieve?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这是一个想法：在与前端不同的域上运行管理应用程序。 cookie 在其他域中无效，因此用户必须重新登录。您所需要的只是一个单独的 Apache vhost 和一个基本的 settings.py，其中只有
INSTALLED_APPS中的contrib.admin。Here's an idea: run the admin app on a different domain to the frontend. The cookies won't be valid in the other domain, so the user will have to log in again. All you'd need would be a separate Apache vhost and a basic settings.py that just has
contrib.admininINSTALLED_APPS.您可能可以实现一个中间件，当从不在管理站点中的引用者访问管理站点时，该中间件要求进行身份验证。它可以将该人注销并让他们重新登录，但即使这样也没有必要。只需输入另一个密码，如果失败则重定向它们。它可能涉及设置会话变量、is_admin_authenticated 或其他内容。
You could probably implement a middleware that asks for authentication when accessing the admin site from a referer not in the admin site. It could log the person out and make them log back in, but even that wouldn't be necessary. Just require another password entry, and redirect them if it fails. It might involve setting a session variable,
is_admin_authenticatedor something.