六十二：CSRF攻擊與防護之系統準備之註冊功能

時間 2019-11-20

原文原文鏈接

CSRF攻擊原理：html

配置信息python

import os
SQLALCHEMY_DATABASE_URI = 'mysql+pymysql://root:123456@127.0.0.1:3306/test'
SQLALCHEMY_TRACK_MODIFICATIONS = False

SECRET_KEY = os.urandom(30)

建立模型：mysql

from flask_sqlalchemy import SQLAlchemy

db = SQLAlchemy()

from exts import db


class User(db.Model):
    __tablename__ = 'user'
    id = db.Column(db.Integer, primary_key=True)  # int類型的主鍵，SQLAlchemy會自動設爲自增
    email = db.Column(db.String(50), nullable=False)
    username = db.Column(db.String(50), nullable=False)
    password = db.Column(db.String(50), nullable=False)
    deposit = db.Column(db.Float, default=0)

主入口sql

from flask import Flask
from exts import db
import config

app = Flask(__name__)
app.config.from_object(config)
db.init_app(app)

if __name__ == '__main__':
    app.run(debug=True)

manager數據庫

from flask_script import Manager
from app import app
from exts import db
from flask_migrate import Migrate, MigrateCommand
from models import User  # 在此導入模型

manager = Manager(app)
Migrate(app, db)
manager.add_command('db', MigrateCommand)

if __name__ == '__main__':
    manager.run()

初始化：python manager.py db initflask

生成遷移腳本：python manager.py db migratesession

把遷移腳本映射到數據庫：python manager.py db migrateapp

form驗證dom

from wtforms import Form, StringField, FloatField
from wtforms.validators import Email, Length, EqualTo, InputRequired


class RegistForm(Form):
    email = StringField(validators=[Email(message='郵箱格式錯誤')])
    username = StringField(validators=[Length(3, 20, message='用戶名長度3~20位')])
    password = StringField(validators=[Length(3, 20, message='用戶名長度3~20位')])
    check_password = StringField(validators=[EqualTo('password', message='兩次密碼不一致')])
    deposit = FloatField(validators=[InputRequired(message='設置餘額')])

註冊的視圖post

from flask import Flask, render_template, views, request
from forms import RegistForm
from exts import db
import config
from models import User

app = Flask(__name__)
app.config.from_object(config)
db.init_app(app)


@app.route('/')
def index():
    return render_template('index.html')


class RegistView(views.MethodView):
    """ 註冊視圖 """

    def get(self):
        return render_template('regist.html')

    def post(self):
        form = RegistForm(request.form)
        if form.validate():
            email = form.email.data
            username = form.username.data
            password = form.password.data
            deposit = form.deposit.data
            user = User(email=email, username=username, password=password, deposit=deposit)
            db.session.add(user)
            db.session.commit()
            return '註冊成功'
        else:
            return f'註冊失敗，錯誤以下：{form.errors}'


app.add_url_rule('/regist/', view_func=RegistView.as_view('regist'))

if __name__ == '__main__':
    app.run(debug=True)

index.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>銀行首頁</title>
</head>
<body>
    <h1>歡迎來到宇宙銀行</h1>
    <ul>
        <li><a href="{{ url_for('regist') }}">去註冊</a></li>
    </ul>
</body>
</html>

regist.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>註冊頁</title>
</head>
<body>
<form action="" method="post">
    <table>
        <tbody>
        <tr>
            <td>郵箱：</td>
            <td><input type="text" name="email"></td>
        </tr>
        <tr>
            <td>用戶名：</td>
            <td><input type="text" name="username"></td>
        </tr>
        <tr>
            <td>密碼：</td>
            <td><input type="text" name="password"></td>
        </tr>
        <tr>
            <td>確認密碼：</td>
            <td><input type="text" name="check_password"></td>
        </tr>
        <tr>
            <td>設置餘額：</td>
            <td><input type="text" name="deposit"></td>
        </tr>
        <tr>
            <td></td>
            <td><input type="submit" value="點擊註冊"></td>
        </tr>
        </tbody>
    </table>
</form>
</body>
</html>