如何驗證失敗後鎖定IP地址？

Question

驗證失敗後是否有一種股票方式可以鎖定IP地址？我沒有看到內置限制如何實現這一點，因爲限制僅在身份驗證和權限成功後纔會啓動。

Answer 1

不是開箱即用，沒有。您需要繼承其中一個身份驗證類，並在自定義auth類中自己實現該行爲。

Answer 2

謝謝湯姆。我用以下代碼分類驗證：

def authenticate(self, request): 

    # 
    # first check to see that IP address is not locked out 
    # due to too many failed authentication requests. 
    # 
    auth_failure_key = 'LOGIN_FAILURES_AT_%s' % request.META.get('REMOTE_ADDR') 

    auth_failures = cache.get(auth_failure_key) or 0 

    # allow up to 3 failures per hour 
    if auth_failures >= 3: 
     raise exceptions.AuthenticationFailed('Locked out: too many authentication failures') 

    try: 
     return super(TokenAuthentication, self).authenticate(request) 
    except exceptions.AuthenticationFailed as e: 

     # update cache 
     cache.set(auth_failure_key, auth_failures + 1, 3600) 

     raise e