Django中的登录限制和防止暴力破解

from django.contrib.auth.models import AbstractUser

class User(AbstractUser):
    ...
    login_attempts = models.IntegerField(default=0)

LOGIN_FAILURE_LOCK_TIME = 5  # 账户被锁定的时间（分钟）
LOGIN_FAILURE_THESHOLD = 5   # 登录失败次数阈值

def lock_account(user):
    user.is_active = False
    user.last_locked_time = timezone.now()
    user.save()

def unlock_account(user):
    if user.is_active:
        return
    if timezone.now() - user.last_locked_time > datetime.timedelta(minutes=LOGIN_FAILURE_LOCK_TIME):
        user.is_active = True
        user.last_locked_time = None
        user.save()

def login(request):
    # ...
    if user.login_attempts >= LOGIN_FAILURE_THESHOLD:
        # 如果登录失败次数超过阈值，检查是否需要锁定账户
        if not user.last_locked_time or timezone.now() - user.last_locked_time > datetime.timedelta(minutes=LOGIN_FAILURE_LOCK_TIME):
            # 账户没有被锁定或者已经过了锁定时间，则解锁账户
            unlock_account(user)
            user.login_attempts = 0
        else:
            # 否则，锁定账户
            lock_account(user)
            return HttpResponse('账户已被锁定，请稍候再试。')
    # ...

LOGIN_FAILURE_IP_LOCK_TIME = 5  # IP地址被锁定的时间（分钟）
LOGIN_FAILURE_IP_THRESHOLD = 5 # IP地址最大登录失败次数

def check_ip_login_failure(ip_address):
    # 检查IP地址是否登录失败次数过多
    failures = LoginFailure.objects.filter(ip_address=ip_address, created_time__gt=timezone.now()-datetime.timedelta(minutes=LOGIN_FAILURE_IP_LOCK_TIME)).count()
    return failures >= LOGIN_FAILURE_IP_THRESHOLD

def login(request):
    # ...
    ip_address = request.META['REMOTE_ADDR']
    if check_ip_login_failure(ip_address):
        # 如果IP地址登录失败次数过多，则拒绝登录请求
        return HttpResponse('登录失败次数过多，请稍候再试。')
    # ...
    # 登录失败时记录登录尝试日志
    LoginFailure.objects.create(ip_address=ip_address, username=username, password=password)

def login(request):
    # ...
    if request.method == 'POST':
        form = LoginForm(request.POST)
        if form.is_valid():
            username = form.cleaned_data['username']
            password = form.cleaned_data['password']
            if check_ip_login_failure(ip_address) or check_user_login_failure(user):
                # 如果登录失败次数过多，则需要输入验证码
                if not request.session.get('login_captcha', False):
                    # 第一次需要输入验证码，生成验证码并发送到前端
                    captcha = CaptchaStore.generate_key()
                    request.session['login_captcha'] = captcha
                    image_url = captcha_url(captcha)
                    return render(request, 'login.html', {'form': form, 'captcha_url': image_url})
                else:
                    # 需要验证验证码是否正确
                    captcha = request.POST.get('captcha', '')
                    if not captcha or not CaptchaStore.objects.filter(response=captcha.lower(), hashkey=request.session['login_captcha']).exists():
                        error = '验证码错误，请重新输入。'
                        return render(request, 'login.html', {'form': form, 'error': error, 'captcha_url': request.session['login_captcha']})
                    else:
                        # 如果验证码正确，则清除登录失败次数记录和验证码信息
                        user.login_attempts = 0
                        LoginFailure.objects.filter(ip_address=ip_address).delete()
                        CaptchaStore.objects.filter(hashkey=request.session['login_captcha']).delete()
                        del request.session['login_captcha']
    # ...