Django令牌：下载具有令牌身份验证的服务器文件

Question

I'm looking for set token authentification in order to download server files with secure way and add after an expiration time.

Requirements :

• Django 1.11
• Ubuntu 18.04
• Database PostgreSQL

Process :

User fills a form with some informations CustomerForm(email, firstname, lastname and country) and he has to choose one or several document(s) with checkboxes.

When form is submitted, I create an object with user informations + document choosen + token generated from email + document_id + datetime in sha1 format.

User gets an email with download link according to previous document(s) (1 email per document).

Expected :

In this part I will explain what I would like to do, but I don't know how it's possible and this part is still fuzzy in my head. It's the first time I'm trying to do that.

User receives an email with url link based on token generated previously. When he clicks into the link, there is an authentification process which let to confirm user and open a window in order to download document file.

But, after few time (maybe 10 minutes) the token is expired and user have to submit the form a new time in order to get document file link.

As I said, it's a bit vague. I have to implement something like that, but I don't know how I could do that.

My files :

I have a class in my view which let to fill the form, generate token and send the email.

Then, I have this new class which let to compare token with database and compare expiration_time with now() too.

The issue is : if I open the link several time, now() is not actualized and my token is always valid and not expirate.

class TokenDownloadView(TemplateView):
    template_name = 'app/token.html'

    def get_context_data(self, **kwargs):
        context = super().get_context_data(**kwargs)
        context['token'] = self.kwargs['token']
        token = context['token']
        print(token)
        download = Download.objects.get(token__iexact=token)

        if download and download.expiration_date > now:
            print("token valide jusqu'à : " + str(download.expiration_date))
            print("il est actuellement : " + str(now))
            print(' ==> Token existe et valide <==')

        if download and download.expiration_date < now:
            print("token valide jusqu'à : " + str(download.expiration_date))
            print("il est actuellement : " + str(now))
            print('==> Token existe mais a expiré <==')

        return context

And this is what I obtain in my terminal in order to display what I said :

d0ce9328a53032d4484cccff4c0bdd92ad701567
token valide jusqu'à : 2018-09-12 07:46:30.082915+00:00
il est actuellement : 2018-09-12 07:45:30.082915+00:00
 ==> Token existe et valide <==
[12/Sep/2018 09:45:42] "GET /crud/download/token/d0ce9328a53032d4484cccff4c0bdd92ad701567/ HTTP/1.1" 200 7447
[12/Sep/2018 09:45:42] "GET /static/css/common-8073709e.css HTTP/1.1" 404 1682
d0ce9328a53032d4484cccff4c0bdd92ad701567
token valide jusqu'à : 2018-09-12 07:46:30.082915+00:00
il est actuellement : 2018-09-12 07:45:30.082915+00:00
 ==> Token existe et valide <==
[12/Sep/2018 09:46:10] "GET /crud/download/token/d0ce9328a53032d4484cccff4c0bdd92ad701567/ HTTP/1.1" 200 7447
[12/Sep/2018 09:46:10] "GET /static/css/common-8073709e.css HTTP/1.1" 404 1682
d0ce9328a53032d4484cccff4c0bdd92ad701567
token valide jusqu'à : 2018-09-12 07:46:30.082915+00:00
il est actuellement : 2018-09-12 07:45:30.082915+00:00
 ==> Token existe et valide <==
[12/Sep/2018 09:46:30] "GET /crud/download/token/d0ce9328a53032d4484cccff4c0bdd92ad701567/ HTTP/1.1" 200 7447
[12/Sep/2018 09:46:30] "GET /static/css/common-8073709e.css HTTP/1.1" 404 1682
d0ce9328a53032d4484cccff4c0bdd92ad701567
token valide jusqu'à : 2018-09-12 07:46:30.082915+00:00
il est actuellement : 2018-09-12 07:45:30.082915+00:00
 ==> Token existe et valide <==
[12/Sep/2018 09:46:41] "GET /crud/download/token/d0ce9328a53032d4484cccff4c0bdd92ad701567/ HTTP/1.1" 200 7447
[12/Sep/2018 09:46:41] "GET /static/css/common-8073709e.css HTTP/1.1" 404 1682

Do you have any idea ?

I suspect cookies and it should be the case, but I don't know how I could remove cookie according to token ?

Answer 1

If you create a url like the following, your logic in the def get(...) on AppHomeView could parse the token and check for timeout before allowing the download. Also you'll probably want to use LoginRequiredMixin on AppHomeView .

Django 2.0

path('download/<slug:token>/', views.AppHomeView.as_view(), name="download_document")

Django 1.11

url(r'^download/(?P<slug>[\\w-]+)/$', views.AppHomeView.as_view(), name='download_document')

If you don't want to put the def get(...) on the AppHomeView , then you could just have two separate views and, following Django standard naming, call them AppCreateView(CreateView) and AppDownloadView(View) and implement the def get(...) that parses the token on the AppDownloadView(View) . The corresponding url would be:

Django 2.0

path('download/<slug:token>/', views.AppDownloadView.as_view(), name="download_document")

Django 1.11

url(r'^download/(?P<slug>[\\w-]+)/$', views.AppDownloadView.as_view(), name='download_document')