Using Django Rest Framework as a Security Level for File System Processing

Question

I am trying to protect the file system of a remote server from unauthorized users. I have a remote repository on another server that stores and processes PDF and PNG from all kinds of processes.

I am using Python 2.7 with Django 1.8 and Django Rest Framework.

I am trying to implement a very simple "proxy layer" that will give me control over who has ever used the file system.

This is mine view.py:

from django.conf import settings

from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import permissions

import requests

class Reports(APIView):
    permission_classes = (permissions.AllowAny,)  #Thats only for now...

    def get(self, request, ssn, validity, file):
        response = requests.get(settings.PROXY_BASE_URL + "/reports/" + ssn + "/" + validity + "/" + file)
        return Response(response)

This concept works for any other GET POST PUT DELETErequest that is a text response (e.g. json response from a remote server).

My problem is when I call this view, I get the default REST method definition page in the browser.

Answer 1

@AlexMorozov, HttpResponse. , Django.

, :

from django.conf import settings

from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import permissions

from django.http import HttpResponse

import requests
import mimetypes


class Reports(APIView):
    permission_classes = (permissions.AllowAny,)

    def get(self, request, ssn, validity, file):
        response = requests.get(settings.PROXY_BASE_URL + "/reports/" + ssn + "/" + validity + "/" + file)
        mimetype = mimetypes.guess_type(settings.PROXY_BASE_URL + "/reports/" + ssn + "/" + validity + "/" + file) #Return an array
        return HttpResponse(response, content_type=mimetype[0])

. :)

Answer 2

, requests DRF Response . :

from django.core.servers.basehttp import FileWrapper

upstream_response = requests.get(settings.PROXY_BASE_URL + "/reports/" + ssn + "/" + validity + "/" + file)
response = Response(FileWrapper(upstream_response.content), content_type='YOUR_MIME_TYPE')
response['Content-Disposition'] = 'attachment; filename="%s"' % 'your_filename.ext'
return response

, ( , ) . django-sendfile . , nginx , .