Implementing an Admin Backend IP Whitelist with Django Middleware

Preface

Django's built-in Admin management backend is very convenient, but there really are quite a few security issues in actual production environments. Regarding admin security protection, I previously researched and implemented adding a login captcha and rate limiting to admin. You can refer to this article: Adding Captcha and Multiple Login Attempt Limits to Django Admin

However, it's much better if it's only used internally, so we can implement IP filtering through Django middleware. Therefore this article involves two knowledge points: one is Django middleware, and the other is how Python handles IP as a data structure.

Let's get into the main topic~

Django Middleware

The concept and usage of middleware are not the focus of this article; please refer to the official documentation yourself—it's written very clearly and easy to understand.

First, we create a new Python package: middleware, and create a Python file admin_secure.py to write our middleware:

import ipaddress

from django.conf import settings
from django.http.response import HttpResponseForbidden

class AdminSecureMiddleware(object):
    """
    Admin 安全中间件
    用于限制可访问 admin 管理后台的IP段
    """

    admin_url = f'/{settings.URL_PREFIX}admin'

    allow_networks = [
        ipaddress.ip_network('10.53.0.0/20'),
    ]

    allow_addresses = []

    @classmethod
    def get_allow_addresses(cls):
        if len(cls.allow_addresses) > 0:
            return cls.allow_addresses

        for network in cls.allow_networks:
            for ip in network:
                cls.allow_addresses.append(ip)

        return cls.allow_addresses

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        response = self.get_response(request)

        ip_addr = ipaddress.ip_address(request.META.get('REMOTE_ADDR'))

        if request.path.startswith(self.admin_url):
            if ip_addr not in self.get_allow_addresses():
                return HttpResponseForbidden()

        return response

Note the code above: you can add the allowed IP network segments in allow_networks , then enable this middleware in settings.py and you're good to go.

This then brings up the second knowledge point covered in this article, which is Python's ipaddress operations.

ipaddress Module

I suddenly feel like slacking off, hahahahaha~

Because this part is really quite simple. The official documentation is: https://docs.python.org/zh-cn/3/howto/ipaddress.html

You haven't given your college computer networking knowledge back to the teacher yet, right (flees~)

References

• https://docs.djangoproject.com/en/3.0/topics/http/middleware/

Welcome to Discuss

I've compiled a series of technical articles and materials. Reply with linux, flutter, c#, netcore, android, kotlin, java, python, etc. in the backend of the WeChat official account "Programming Lab" to get related technical articles and materials. If you have any questions, you can also leave a message in the official account backend~