31 lines
1.3 KiB
Python
31 lines
1.3 KiB
Python
"""中间件注册顺序：限流须在 DB 会话/操作日志之外（更外层），
|
|
否则被限流的请求仍先开 DB 会话、仍写操作日志，DoS 时放大 DB 与日志负担。"""
|
|
from core.app import create_app
|
|
|
|
|
|
def _middleware_names(app):
|
|
"""按执行顺序（列表最前 = 最外层/先执行）提取各中间件名。"""
|
|
names = []
|
|
for m in app.user_middleware:
|
|
dispatch = getattr(m, 'kwargs', {}).get('dispatch')
|
|
if dispatch is not None:
|
|
names.append(getattr(dispatch, '__name__', str(dispatch)))
|
|
else:
|
|
names.append(getattr(m.cls, '__name__', str(m)))
|
|
return names
|
|
|
|
|
|
def test_rate_limit_runs_before_db_session_and_operation_log():
|
|
names = _middleware_names(create_app())
|
|
# 限流必须比 DB 会话 / 操作日志更外层（先执行），拒绝请求不进入 DB 与日志
|
|
assert 'rate_limit_middleware' in names
|
|
assert names.index('rate_limit_middleware') < names.index('db_session_middleware')
|
|
assert names.index('rate_limit_middleware') < names.index('operation_log_middleware')
|
|
|
|
|
|
def test_cors_is_outermost():
|
|
names = _middleware_names(create_app())
|
|
# CORS 在最外层，直接返回的响应也带 CORS 头
|
|
assert 'CORSMiddleware' in names
|
|
assert names.index('CORSMiddleware') == 0
|