python web應用程序的某些部分可以安全而其他人不可以嗎？

Question

我正在尋找切換到python/django爲我的網頁開發。對於一些需要端口的應用程序，我通過SSL提供站點的管理部分，而主界面不是。

有沒有辦法通過SSL說服一個Django應用程序的管理部分，而該網站的其餘部分是通過HTTP？

Answer 1

它絕對有可能。如果您正在使用nginx，這個你會怎麼做：

在/etc/nginx/sites-available/default，添加您的服務器標籤下面的下面，並適當配置文件：

#SSL Support added 
    listen 443 ssl; 
    ssl_certificate  /etc/ssl/ssl/nginx/server.crt; 
    ssl_certificate_key /etc/ssl/ssl/nginx/server.key; 
    ssl_protocols  SSLv3 TLSv1 TLSv1.1 TLSv1.2; 
    ssl_ciphers   HIGH:!aNULL:!MD5; 

在middleware.py

然後，

class SecureRequiredMiddleware(object): 
    def __init__(self): 
     self.paths = getattr(settings, 'SECURE_REQUIRED_PATHS') 
     self.enabled = self.paths and getattr(settings, 'HTTPS_SUPPORT') 

    def process_request(self, request): 
     if self.enabled and not request.is_secure(): 
      for path in self.paths: 
       if request.get_full_path().startswith(path): 
        request_url = request.build_absolute_uri(request.get_full_path()) 
        secure_url = request_url.replace('http://', 'https://') 
        print self.paths, request_url, secure_url 
        return HttpResponsePermanentRedirect(secure_url) 
     return None 

settings.py中

然後，

.... 
MIDDLEWARE_CLASSES = (
    'django.middleware.common.CommonMiddleware', 
    'django.contrib.sessions.middleware.SessionMiddleware', 
    'django.middleware.csrf.CsrfViewMiddleware', 
    'django.contrib.auth.middleware.AuthenticationMiddleware', 
    'django.contrib.messages.middleware.MessageMiddleware', 
    # Uncomment the next line for simple clickjacking protection: 
    'django.middleware.clickjacking.XFrameOptionsMiddleware', 
    'djo.middleware.SecureRequiredMiddleware', 
.... 
HTTPS_SUPPORT = True 
SECURE_REQUIRED_PATHS = (
    r'/admin/', 
) 

這應該讓你開始。