CSRF攻击的原理:
①用户正常登录A银行网站,
②A网站返回cookie信息给用户,浏览器保存cookie信息
③在A网站没有退出登录的情况下(或者说cookie信息没过期), 登录了恶意网站B
④恶意网站B,提前准备好转账表单或者其它请求 ,将其隐藏. 把提交到A网站的按钮设置为一个"领取优惠券"的图片链接.用户 点击链接
⑤在用户主观未知的情况下,访问A网站,此时浏览器会自动携带cookie信息
⑥A网站识别到cookie信息,默认为是用户本人做出的请求,根据请求做出相应的操作.
⑦用户收到损失.
flask的处理方式：
1、简单Flask程序
from flask import Flask
app = Flask(__name__)
@app.route('/')
def hello_world():
return 'Hello World!'
if __name__ == '__main__':
app.run()
2、Flask运行流程
2.1、实例化Flask类生产app对象
from flask import Flask app = Flask(__name__)
2.2、注册url，路由，endpoint到内存中
@app.route('/')
def hello_world():
return 'Hello World!'
2.2.1、class Flask(_PackageBoundObject) 类中route()方法
def route(self, rule, **options):
def decorator(f):
endpoint = options.pop('endpoint', None)
self.add_url_rule(rule, endpoint, f, **options)
return f
return decorator
2.2.2、class Flask(_PackageBoundObject) 类中add_url_rule()方法
def add_url_rule(self, rule, endpoint=None, view_func=None, **options):
if endpoint is None:
endpoint = _endpoint_from_view_func(view_func)
options['endpoint'] = endpoint
methods = options.pop('methods', None)
# if the methods are not given and the view_func object knows its
# methods we can use that instead. If neither exists, we go with
# a tuple of only ``GET`` as default.
if methods is None:
methods = getattr(view_func, 'methods', None) or ('GET',)
if isinstance(methods, string_types):
raise TypeError('Allowed methods have to be iterables of strings, '
'for example: @app.route(..., methods=["POST"])')
methods = set(item.upper() for item in methods)
# Methods that should always be added
required_methods = set(getattr(view_func, 'required_methods', ()))
# starting with Flask 0.8 the view_func object can disable and
# force-enable the automatic options handling.
provide_automatic_options = getattr(view_func,
'provide_automatic_options', None)
if provide_automatic_options is None:
if 'OPTIONS' not in methods:
provide_automatic_options = True
required_methods.add('OPTIONS')
else:
provide_automatic_options = False
# Add the required methods now.
methods |= required_methods
rule = self.url_rule_class(rule, methods=methods, **options)
rule.provide_automatic_options = provide_automatic_options
self.url_map.add(rule)
if view_func is not None:
old_func = self.view_functions.get(endpoint)
if old_func is not None and old_func != view_func:
raise AssertionError('View function mapping is overwriting an '
'existing endpoint function: %s' % endpoint)
self.view_functions[endpoint] = view_func
执行完之后，将url放入app.url_map中；将视图函数放入app.view_functions中：
2.3、运行app.run()，检测客户端请求，并作出响应
if __name__ == '__main__':
app.run()
2.3.1、执行Flask类中的run()方法
def run(self, host=None, port=None, debug=None, **options):
from werkzeug.serving import run_simple
if host is None:
host = '127.0.0.1'
if port is None:
server_name = self.config['SERVER_NAME']
if server_name and ':' in server_name:
port = int(server_name.rsplit(':', 1)[1])
else:
port = 5000
if debug is not None:
self.debug = bool(debug)
options.setdefault('use_reloader', self.debug)
options.setdefault('use_debugger', self.debug)
try:
run_simple(host, port, self, **options)
finally:
# reset the first request information if the development server
# reset normally. This makes it possible to restart the server
# without reloader and that stuff from an interactive shell.
self._got_first_request = False
try之前的代码都是配置host、port、debug等参数。try中调用wsgi工具包werkzeug中的runsimple函数，用来建立socket链接，监听客户端数据，并进行解析处理，然后通过路由匹配找到视图函数，将数据交给视图处理后，再进行打包发给客户端。最后一行代码是将app中的_got_first_request标志置为False。当第一次客户端请求到来时置位True，用来触发before_first_request装饰器（第一次请求来在视图函数前面执行的代码）的运行。
2.3.2、请求来的时候执行流程
请求来的时候执行run_simple(host, port, self, **options)中的第三个参数，即self()，self就是app，因此执行Flask类中__call__方法。
Flask类中__call__方法：
def __call__(self, environ, start_response):
"""Shortcut for :attr:`wsgi_app`."""
return self.wsgi_app(environ, start_response)
2.3.3、wsgi_app中的environ,start_response
from werkzeug.wrappers import Response
from werkzeug.serving import run_simple
def run_server(environ, start_response):
print("environ:",environ)
print("type environ:",type(environ))
print("start_response:", start_response)
print("type start_response:", type(start_response))
response = Response('hello')
return response(environ, start_response)
if __name__ == '__main__':
run_simple('127.0.0.1', 8000, run_server)
environ的类型是：<class 'dict'>，即字典类型
environ的内容如下：
environ: {
'wsgi.version': (1, 0),
'wsgi.url_scheme': 'http',
'wsgi.input': < _io.BufferedReader name = 736 > ,
'wsgi.errors': < _io.TextIOWrapper name = '<stderr>'
mode = 'w'
encoding = 'UTF-8' > ,
'wsgi.multithread': False,
'wsgi.multiprocess': False,
'wsgi.run_once': False,
'werkzeug.server.shutdown': < function WSGIRequestHandler.make_environ. < locals > .shutdown_server at 0x0000000012E1B510 > ,
'SERVER_SOFTWARE': 'Werkzeug/0.14.1',
'REQUEST_METHOD': 'POST',
'SCRIPT_NAME': '',
'PATH_INFO': '/',
'QUERY_STRING': '',
'REMOTE_ADDR': '127.0.0.1',
'REMOTE_PORT': 11556,
'SERVER_NAME': '127.0.0.1',
'SERVER_PORT': '8000',
'SERVER_PROTOCOL': 'HTTP/1.1',
'CONTENT_TYPE': 'application/json',
'HTTP_CACHE_CONTROL': 'no-cache',
'HTTP_POSTMAN_TOKEN': 'fc8d2fdf-23c6-4461-9177-9c3965f09932',
'HTTP_USER_AGENT': 'PostmanRuntime/7.3.0',
'HTTP_ACCEPT': '*/*',
'HTTP_HOST': '127.0.0.1:8000',
'HTTP_ACCEPT_ENCODING': 'gzip, deflate',
'CONTENT_LENGTH': '0',
'HTTP_CONNECTION': 'keep-alive'
}
start_response的类型是：<class 'function'>，即函数类型
start_response的内容：
start_response: <function WSGIRequestHandler.run_wsgi.<locals>.start_response at 0x0000000012E2C510>
2.4、Flask类中的wsgi_app()方法
def wsgi_app(self, environ, start_response):
ctx = self.request_context(environ)
ctx.push()
error = None
try:
try:
# 对请求进行处理
response = self.full_dispatch_request()
except Exception as e:
error = e
# 处理异常
response = self.handle_exception(e)
except:
error = sys.exc_info()[1]
raise
# 将处理后的数据返回
return response(environ, start_response)
finally:
if self.should_ignore_error(error):
error = None
ctx.auto_pop(error)
2.5、Flask类中的full_dispatch_request()方法
def full_dispatch_request(self):
"""Dispatches the request and on top of that performs request
pre and postprocessing as well as HTTP exception catching and
error handling.
.. versionadded:: 0.7
"""
# 处理第一次请求前的装饰器before_first_requst函数
self.try_trigger_before_first_request_functions()
try:
request_started.send(self)
rv = self.preprocess_request()
# 如果before_request函数们处理返回的值为None，则进行正式处理
if rv is None:
rv = self.dispatch_request()
except Exception as e:
rv = self.handle_user_exception(e)
# 使用after_response装饰器函数对视图函数执行后的结果进行处理
return self.finalize_request(rv)
2.5.1、Flask类中的try_trigger_before_first_request_functions()方法
def try_trigger_before_first_request_functions(self):
"""Called before each request and will ensure that it triggers
the :attr:`before_first_request_funcs` and only exactly once per
application instance (which means process usually).
:internal:
"""
if self._got_first_request:
return
with self._before_request_lock:
if self._got_first_request:
return
# self.before_first_request_funcs = [],列表中存放函数
for func in self.before_first_request_funcs:
func()
self._got_first_request = True
2.5.2、Flask类中的preprocess_request()方法
def preprocess_request(self):
"""Called before the actual request dispatching and will
call each :meth:`before_request` decorated function, passing no
arguments.
If any of these functions returns a value, it's handled as
if it was the return value from the view and further
request handling is stopped.
This also triggers the :meth:`url_value_preprocessor` functions before
the actual :meth:`before_request` functions are called.
"""
bp = _request_ctx_stack.top.request.blueprint
funcs = self.url_value_preprocessors.get(None, ())
if bp is not None and bp in self.url_value_preprocessors:
funcs = chain(funcs, self.url_value_preprocessors[bp])
for func in funcs:
func(request.endpoint, request.view_args)
# 获取before_requesth装饰器函数并处理
funcs = self.before_request_funcs.get(None, ())
if bp is not None and bp in self.before_request_funcs:
funcs = chain(funcs, self.before_request_funcs[bp])
for func in funcs:
rv = func()
if rv is not None:
return rv
2.5.3、Flask类中的dispatch_request()方法
def dispatch_request(self):
"""Does the request dispatching. Matches the URL and returns the
return value of the view or error handler. This does not have to
be a response object. In order to convert the return value to a
proper response object, call :func:`make_response`.
.. versionchanged:: 0.7
This no longer does the exception handling, this code was
moved to the new :meth:`full_dispatch_request`.
"""
req = _request_ctx_stack.top.request
if req.routing_exception is not None:
self.raise_routing_exception(req)
rule = req.url_rule
# if we provide automatic options for this URL and the
# request came with the OPTIONS method, reply automatically
if getattr(rule, 'provide_automatic_options', False) \
and req.method == 'OPTIONS':
return self.make_default_options_response()
# otherwise dispatch to the handler for that endpoint
# 根据rule.endpoint找到app.view_functions中对应的处理函数，然后将req.view_args传入，
# 进行视图函数处理，最后将结果返回
return self.view_functions[rule.endpoint](**req.view_args)
