Django不活跃用户自动登出：会话管理与服务器端任务的权衡

# myapp/middleware.py from django.contrib.auth import logout from django.utils import timezone from datetime import timedelta  class AutoLogoutMiddleware:     def __init__(self, get_response):         self.get_response = get_response         # 定义不活跃超时时间，例如30分钟         self.INACTIVITY_TIMEOUT = timedelta(minutes=30)      def __call__(self, request):         # 仅对已认证的用户进行处理         if request.user.is_authenticated:             # 从会话中获取或初始化最后活跃时间             last_activity_str = request.session.get('last_activity')             last_activity = None             if last_activity_str:                 try:                     last_activity = timezone.datetime.fromisoformat(last_activity_str)                 except ValueError:                     # 如果存储的格式不正确，则重置                     last_activity = None              # 如果没有记录或记录有问题，则视为当前请求为首次活跃             if not last_activity:                 request.session['last_activity'] = timezone.now().isoformat()                 # 设置会话过期时间为不活跃超时时间                 request.session.set_expiry(self.INACTIVITY_TIMEOUT.total_seconds())             else:                 # 检查是否超时                 if (timezone.now() - last_activity) > self.INACTIVITY_TIMEOUT:                     # 用户不活跃，执行登出操作                     logout(request)                     # 清除会话中的last_activity，防止下次请求误判                     if 'last_activity' in request.session:                         del request.session['last_activity']                     # 可选：在这里更新用户模型中的isCurrentlyActive字段                     # 例如：request.user.userprofile.isCurrentlyActive = False                     #       request.user.userprofile.save()                     print(f"User {request.user.username} logged out due to inactivity.")                 else:                     # 用户活跃，更新最后活跃时间并延长会话过期时间                     request.session['last_activity'] = timezone.now().isoformat()                     request.session.set_expiry(self.INACTIVITY_TIMEOUT.total_seconds())          response = self.get_response(request)         return response  # 在settings.py中添加此中间件 # MIDDLEWARE = [ #     ... #     'myapp.middleware.AutoLogoutMiddleware', #     ... # ]

Designer

Microsoft推出的图形设计应用程序

63

查看详情

# myapp/tasks.py from celery import shared_task from django.utils import timezone from datetime import timedelta from django.contrib.sessions.models import Session from django.contrib.auth.models import User # 假设UserProfile关联User  # 假设用户模型扩展或有UserProfile模型，包含last_active_timestamp和isCurrentlyActive # from myapp.models import UserProfile   @shared_task def check_inactive_users():     """     定期检查并处理不活跃用户。     """     INACTIVITY_THRESHOLD = timedelta(minutes=30) # 不活跃阈值     now = timezone.now()      # 找出所有在阈值时间前活跃，且当前标记为活跃的用户     # 这里假设User模型有last_active_timestamp和isCurrentlyActive字段     # 如果是UserProfile，则查询UserProfile     inactive_users = User.objects.filter(         last_active_timestamp__lt=now - INACTIVITY_THRESHOLD,         isCurrentlyActive=True # 仅处理当前被标记为活跃的用户     )      for user in inactive_users:         # 更新用户状态为不活跃         user.isCurrentlyActive = False         user.save()         print(f"User {user.username} marked as inactive.")          # 可选：强制登出用户，删除其所有会话         # 注意：这会登出用户在所有设备上的会话         # user.get_all_sessions() 是一个方便的方法来获取用户的所有会话         for session in user.get_all_sessions():             session.delete()         print(f"User {user.username}'s sessions have been deleted (forced logout).")  # 配置Celery Beat来调度此任务，例如每隔1分钟运行一次 # 在 settings.py 中配置 Celery Beat # CELERY_BEAT_SCHEDULE = { #     'check-inactive-users-every-minute': { #         'task': 'myapp.tasks.check_inactive_users', #         'schedule': timedelta(minutes=1), #     }, # }