python - Django 中间件建议不要使用 request.POST 为什么？

Question

“在 View 运行之前或在 process_view() 中访问中间件内部的 request.POST 将阻止中间件之后运行的任何 View 修改请求的上传处理程序，通常应该避免。”

这来自 django 文档。首先，如果我只是阅读帖子，而不对其进行更改，那么它如何知道以及如何阻止 View 执行其业务，其次，从这个意义上讲，CsrfViewMiddleware 有什么不同？

Answer 1

警告来自this ticket和 this 。

<小时/>

Django currently parses the POST data lazily, but middlware might try to access POST on a request and trigger parsing, even though the function itself never touches POST.

<小时/>

That would put high load on the machine if the POST data is rather large ...

<小时/>

It means that the view will be unable to set any custom upload handlers, perform custom parsing of the request body, or enforce permission checks prior to file uploads being accepted.

关于 CsrfViewMiddleware 的区别在 docs 中的上述警告下方清楚地说明了:

The CsrfViewMiddleware ... provides the csrf_exempt() and csrf_protect() decorators which allow views to explicitly control at what point the CSRF validation should occur.