当前位置：首页 > news >正文

Django Admin自定义登录功能实现与安全优化

news 2026/7/19 2:56:06

1. Django Admin自定义登录功能深度解析

作为Django开发者，我们都知道admin后台是快速构建管理界面的利器。但默认的登录界面可能无法满足所有项目的需求，比如需要：

添加图形验证码
集成第三方登录（微信/钉钉等）
修改登录页样式与企业品牌一致
增加多因素认证
实现登录行为审计

1.1 核心实现原理

Django admin的登录功能主要由以下组件构成：

AdminSite类：提供admin站点的整体功能
login()视图方法：处理登录逻辑
login_template属性：指定登录模板路径

自定义登录的核心思路是：

继承默认AdminSite类
重写登录视图或模板
注册自定义的AdminSite实例

1.2 完整实现步骤

1.2.1 创建自定义AdminSite

# myapp/admin.py from django.contrib.admin import AdminSite from django import forms from django.contrib.auth.forms import AuthenticationForm class CustomLoginForm(AuthenticationForm): # 添加自定义字段如验证码 captcha = forms.CharField( label='验证码', required=True ) class MyAdminSite(AdminSite): login_form = CustomLoginForm # 使用自定义表单 login_template = 'admin/custom_login.html' # 自定义模板路径 def get_urls(self): # 保留原有URLs urls = super().get_urls() # 添加自定义登录处理逻辑 from django.urls import path custom_urls = [ path('custom_login/', self.admin_view(self.custom_login), name='custom_login'), ] return custom_urls + urls def custom_login(self, request): # 自定义登录处理逻辑 if request.method == 'POST': # 处理表单数据 pass from django.contrib.auth.views import LoginView return LoginView.as_view( template_name=self.login_template, authentication_form=self.login_form, extra_context=self.each_context(request) )(request) # 实例化自定义AdminSite admin_site = MyAdminSite(name='myadmin')

1.2.2 创建自定义登录模板

在templates/admin/目录下创建custom_login.html：

{% extends "admin/login.html" %} {% block content %} <div class="login-box"> <h2>企业后台管理系统</h2> {% if form.errors %} <p class="errornote">用户名或密码错误</p> {% endif %} <form method="post" id="login-form"> {% csrf_token %} <div class="form-row"> {{ form.username.label_tag }} {{ form.username }} </div> <div class="form-row"> {{ form.password.label_tag }} {{ form.password }} </div> <div class="form-row"> {{ form.captcha.label_tag }} {{ form.captcha }} <img src="{% url 'captcha-image' %}" alt="验证码" class="captcha"> </div> <div class="submit-row"> <input type="submit" value="登录"> </div> </form> </div> <style> .login-box { background: white; padding: 20px; border-radius: 5px; box-shadow: 0 0 10px rgba(0,0,0,0.1); max-width: 400px; margin: 0 auto; } .captcha { margin-top: 10px; cursor: pointer; } </style>

1.2.3 注册模型和路由

# urls.py from myapp.admin import admin_site urlpatterns = [ path('admin/', admin_site.urls), # 其他URL配置... ] # admin.py from django.contrib import admin from .models import MyModel # 使用自定义admin_site注册模型 admin_site.register(MyModel)

1.3 高级定制技巧

1.3.1 添加多因素认证

def custom_login(self, request): if request.method == 'POST' and 'otp' not in request.POST: form = self.login_form(data=request.POST) if form.is_valid(): # 验证用户名密码后进入OTP验证 request.session['pre_auth_user'] = form.get_user().id return render(request, 'admin/otp_verify.html') if request.method == 'POST' and 'otp' in request.POST: user_id = request.session.get('pre_auth_user') if user_id and validate_otp(user_id, request.POST['otp']): user = User.objects.get(id=user_id) login(request, user) return HttpResponseRedirect(request.GET.get('next', '/admin/')) return super().custom_login(request)

1.3.2 登录审计日志

from django.contrib.auth.signals import user_logged_in from django.dispatch import receiver @receiver(user_logged_in) def log_user_login(sender, request, user, **kwargs): from .models import LoginLog LoginLog.objects.create( user=user, ip=request.META.get('REMOTE_ADDR'), user_agent=request.META.get('HTTP_USER_AGENT') )

1.3.3 集成第三方登录

# 添加微信登录按钮 def get_login_context(self, request): context = super().get_login_context(request) context.update({ 'wechat_login_url': reverse('wechat-auth'), 'dingtalk_login_url': reverse('dingtalk-auth') }) return context

2. 安全增强方案

2.1 防止暴力破解

from django.core.cache import cache from django.http import HttpResponseForbidden class CustomLoginForm(AuthenticationForm): def clean(self): ip = self.request.META.get('REMOTE_ADDR') fail_count = cache.get(f'login_fail_{ip}', 0) if fail_count >= 5: raise forms.ValidationError( "登录失败次数过多，请10分钟后再试", code='too_many_failures' ) try: cleaned_data = super().clean() cache.delete(f'login_fail_{ip}') return cleaned_data except forms.ValidationError: cache.set(f'login_fail_{ip}', fail_count + 1, 600) raise

2.2 密码强度策略

from django.contrib.auth.password_validation import validate_password from django.core.exceptions import ValidationError class CustomUserCreationForm(UserCreationForm): def clean_password2(self): password2 = super().clean_password2() try: validate_password(password2, self.instance) except ValidationError as e: raise forms.ValidationError(e.messages) return password2 admin_site.register(User, CustomUserAdmin)

3. 性能优化建议

3.1 缓存登录页面

from django.views.decorators.cache import never_cache class MyAdminSite(AdminSite): @never_cache def login(self, request, extra_context=None): # 只有登录页需要禁用缓存 return super().login(request, extra_context) def custom_login(self, request): # 其他自定义视图可以适当缓存 return cache_page(60*15)(self._custom_login)(request)

3.2 异步日志记录

from celery import shared_task @shared_task def async_log_login(user_id, ip, user_agent): from .models import LoginLog LoginLog.objects.create( user_id=user_id, ip=ip, user_agent=user_agent ) @receiver(user_logged_in) def log_user_login(sender, request, user, **kwargs): async_log_login.delay( user.id, request.META.get('REMOTE_ADDR'), request.META.get('HTTP_USER_AGENT') )

4. 企业级解决方案

4.1 LDAP/AD集成

import ldap from django_auth_ldap.config import LDAPSearch AUTH_LDAP_SERVER_URI = "ldap://ldap.example.com" AUTH_LDAP_BIND_DN = "cn=admin,dc=example,dc=com" AUTH_LDAP_BIND_PASSWORD = "password" AUTH_LDAP_USER_SEARCH = LDAPSearch( "ou=users,dc=example,dc=com", ldap.SCOPE_SUBTREE, "(uid=%(user)s)" ) AUTHENTICATION_BACKENDS = [ 'django_auth_ldap.backend.LDAPBackend', 'django.contrib.auth.backends.ModelBackend', ]

4.2 单点登录(SSO)集成

from django.contrib.auth import login from django.http import HttpResponseRedirect class MyAdminSite(AdminSite): def login(self, request, extra_context=None): if request.GET.get('sso_token'): try: user = validate_sso_token(request.GET['sso_token']) login(request, user) return HttpResponseRedirect(request.GET.get('next', '/admin/')) except SSOValidationError: pass return super().login(request, extra_context)