我如何检查管理员用户是否已登录django网站或未登录NGINX

Question

I want to see that admin user is logged in or not into nginx.conf file .
I need this for my specific requirement. My Try :

I tried to fetch COOKIES into nginx.conf file.
but when admin is logged out so cookies are changed so i am not able figure out that if a admin is logged in or not.

Answer 1

As far as I know this is not possible.

Django uses encrypted cookies by default and stores all data in the session table in the DB (also encrypted). You could check if the user has a cookie set in nginx but you won't be able to verify if that cookie value actually means "Admin" or "random other cookie value".

Also unless you're using custom nginx modules to check the contents of the cookie you run the risk of someone managing to trick nginx into thinking the user is an admin when that is not the case.

I'm not sure what the use case is here but you could try doing something with the django middleware or looking for third party plugins instead of using nginx.

If you want to limit file access to a specific file, eg admin-only images/javascript/data files or such you could try the HttpAccessKeyModule for Nginx and just generate a custom 'url' for your admin to access them.

You can also try looking into: http://nginx.org/en/docs/http/ngx_http_auth_request_module.html and see about delegating the check to some part of Django which just returns Yes or No to nginx.

There might be another nginx plugin somewhere which you can add/enable for an admin user from within django. But this requires you to think the other way around. With django telling nginx the user is an admin. Instead of nginx finding it out itself.

Hope this helps you in some way.