如何防止redirect_to_login攻击LOGIN_REDIRECT_URL

Question

因此，一般来说，当用户登录时，我的应用程序将他重定向到dashboard-overview

# settings.py

# Login and Logout target routes
LOGIN_URL = 'login'
LOGIN_REDIRECT_URL = 'dashboard-overview'
LOGOUT_REDIRECT_URL = '/'

但是，对于特定情况，我希望使用辅助函数将用户重定向到“计算器-页面”，因为用户再次被重定向到LOGIN_REDIRECT_URL的值，这是不起作用的。

# views.py

def render_calculator(request, slug):
    """
    Renders the calculator page
    """
    # Check for the user being authenticated
    if not request.user.is_authenticated:
        return redirect_to_login('calculator-page')
   
        # routes to http://127.0.0.1:8000/login/?next=calculator-page which looks fine, 
        # but then it fails after login to re-route as specified and sends to
        # 'dashboard-overview' again

    else:

        club_obj = Offer.objects.get(club__slug=slug)

        # Create Context
        context = {
            'club_obj': club_obj,
        }

        return render(request, 'core/calculator.html', context)

# urls.py 

from django.urls import path, include
from django.contrib.auth import views
from applications.user import views as user_views

urlpatterns = [

    # Login View
    path('login/', views.LoginView.as_view(template_name='user/login.html'), name="login"),
    path('logout/', views.LogoutView.as_view(), name="logout"),

    # Sign Up
    path('signup/', user_views.signup, name='signup'),

]

# template user/login.html

{% extends 'user/user_frame.html' %}
{% load static %}

<!-- Styles -->
{% block styles %}
    <link href="{% static 'css/user_frame.css' %}" rel="stylesheet" type="text/css">
{% endblock styles %}


{% block form %}

    <div class="logo-container"><a href="/" style="margin: 0"><img src="{% static 'images/logo_negative_text.svg' %}" class="logo-image"></a></div>

    <div class="form-container">

        <!-- form headline -->
        <h1 class="form-headline">Login to your Farena Account</h1>
        <!-- form -->
        <form class="form" method="post" action=".">
            {% csrf_token %}
            <div class="error-wrapper">
                <div class="errors">{{ form.non_field_errors }}</div>
            </div>
            <div class="email-wrapper field-wrapper">
                <div class="tag name-tag">{{ form.username.label }}*</div>
                <div class="input">{{ form.username }}</div>
            </div>
            <div class="password-wrapper field-wrapper">
                <div class="tag">{{ form.password.label }}*</div>
                <div class="input">{{ form.password }}</div>
                <a href="/password_change/"><div class="forgot-password">Forgot Password?</div></a>
            </div>
            <!-- submit button -->
            <button class="login-button" type="submit">Log In</button>
        </form>
    </div>

    <a href="/signup"><div class="account-info">No account yet? Sign Up!</div></a>

{% endblock form %}

Answer 1

问题在于您的登录视图模板-您缺少了next表单字段，该字段告诉Django在用户登录后在何处重定向。请参阅此视图的示例模板代码的文档。

具体来说，您需要在表单中添加以下内容：

<input type="hidden" name="next" value="{{ next }}">

现在缺少这一点，这意味着Django将始终默认为LOGIN_REDIRECT_URL。