Django的AuthenticationMiddleware有什么技巧

Question

我在阅读Django的源代码时，遇到了关于AuthenticationMiddleware的问题。

根据文档的说法，AuthenticationMiddleware

会把用户属性（一个User模型的实例）添加到每一个传入的Http请求中。

但是我不太明白这个是怎么在AuthenticationMiddleware.process_request()中实现的。下面的代码显示，process_request这里只是把一个LazyUser()赋值给request.__class__，这和User模型没有关系。而且LazyUser.__get__()看起来很奇怪，让我感到很困惑。

class LazyUser(object):
    def __get__(self, request, obj_type=None):
        if not hasattr(request, '_cached_user'):
            from django.contrib.auth import get_user
            request._cached_user = get_user(request)
        return request._cached_user

class AuthenticationMiddleware(object):
    def process_request(self, request):
        assert hasattr(request, 'session'), "The Django authentication middleware requires session middleware to be installed. Edit your MIDDLEWARE_CLASSES setting to insert 'django.contrib.sessions.middleware.SessionMiddleware'."
        request.__class__.user = LazyUser()
        return None

简单来说，我想知道在AuthenticationMiddleware处理HttpRequest时，幕后到底发生了什么？

Answer 1

LazyUser 就像是一个懒惰的包装器。它的 get 方法是 Python 中的一种特殊方法，当你访问这个对象时，它会被调用。因此，用户的具体信息只有在真正需要的时候才会被确定。这是有道理的，因为这个操作会触发数据库的调用，而这些调用只有在用户确实需要的时候才应该发生。

LazyUser 并不是直接分配给请求实例本身，而是分配给请求的实例类，这样它也能在实例中使用。为什么要这样做，我就不太清楚了。

Answer 2

LazyUser对象是一个Python描述符，也就是说，它是一个可以控制自己如何通过其父类的实例来访问的对象。（听起来有点复杂。）让我来给你简单解释一下：

# Having a LazyUser means we don't have to get the actual User object
# for each request before it's actually accessed.
class LazyUser(object):
    # Define the __get__ operation for the descripted object.
    # According to the docs, "descr.__get__(self, obj, type=None) --> value".
    # We don't need the type (obj_type) for anything, so don't mind that.
    def __get__(self, request, obj_type=None):
        # This particular request doesn't have a cached user?
        if not hasattr(request, '_cached_user'):
            # Then let's go get it!
            from django.contrib.auth import get_user
            # And save it to that "hidden" field.
            request._cached_user = get_user(request)
        # Okay, now we have it, so return it.
        return request._cached_user

class AuthenticationMiddleware(object):
    # This is done for every request...
    def process_request(self, request):
        # Sanity checking.
        assert hasattr(request, 'session'), "blah blah blah."
        # Put the descriptor in the class's dictionary. It can thus be
        # accessed by the class's instances with `.user`,  and that'll
        # trigger the above __get__ method, eventually returning an User, 
        # AnonymousUser, or what-have-you.
        # Come to think of it, this probably wouldn't have to be done 
        # every time, but the performance gain of checking whether we already
        # have an User attribute would be negligible, or maybe even negative.
        request.__class__.user = LazyUser()
        # We didn't mess with the request enough to have to return a
        # response, so return None.
        return None

这样解释有没有帮助呢？ :)