发送错误
- 通过邮件方式报告
  - Server errors
  - 404 errors
- Filtering error reports
  - Filtering sensitive information
  - Custom error reports

发送错误

当您运行着公开的网页时，你应该把设置中的 DEBUG 选项设为关闭。这将使您的服务器运行得更快，并且还可以防止恶意用户在错误页面中看到应用的详细信息。

然而，把 DEBUG 设置为 False，这意味着你永远不会在你的网站上看到错误的细节，所有的人都只是看到你公开的错误页面。当你需要在部署的网页上追踪出现的错误，Django 可以通过设置去报告错误的细节。

通过邮件方式报告

Server errors

When DEBUG is False, Django will email the users listed in theADMINS setting whenever your code raises an unhandled exception andresults in an internal server error (HTTP status code 500). This gives theadministrators immediate notification of any errors. The ADMINS willget a description of the error, a complete Python traceback, and details aboutthe HTTP request that caused the error.

注解

In order to send email, Django requires a few settings telling ithow to connect to your mail server. At the very least, you'll needto specify EMAIL_HOST and possiblyEMAIL_HOST_USER and EMAIL_HOST_PASSWORD,though other settings may be also required depending on your mailserver's configuration. Consult the Django settingsdocumentation for a full list of email-relatedsettings.

By default, Django will send email from root@localhost. However, some mailproviders reject all email from this address. To use a different senderaddress, modify the SERVER_EMAIL setting.

To activate this behavior, put the email addresses of the recipients in theADMINS setting.

参见

Server error emails are sent using the logging framework, so you cancustomize this behavior by customizing your logging configuration.

404 errors

Django can also be configured to email errors about broken links (404 "pagenot found" errors). Django sends emails about 404 errors when:

DEBUG is False;
Your MIDDLEWARE setting includesdjango.middleware.common.BrokenLinkEmailsMiddleware.
If those conditions are met, Django will email the users listed in theMANAGERS setting whenever your code raises a 404 and the request hasa referer. It doesn't bother to email for 404s that don't have a referer —those are usually just people typing in broken URLs or broken Web bots. It alsoignores 404s when the referer is equal to the requested URL, since thisbehavior is from broken Web bots too.

注解

BrokenLinkEmailsMiddleware must appearbefore other middleware that intercepts 404 errors, such asLocaleMiddleware orFlatpageFallbackMiddleware.Put it towards the top of your MIDDLEWARE setting.

You can tell Django to stop reporting particular 404s by tweaking theIGNORABLE_404_URLS setting. It should be a list of compiledregular expression objects. For example:

import re
IGNORABLE_404_URLS = [
    re.compile(r'\.(php|cgi)$'),
    re.compile(r'^/phpmyadmin/'),
]

In this example, a 404 to any URL ending with .php or .cgi will not bereported. Neither will any URL starting with /phpmyadmin/.

The following example shows how to exclude some conventional URLs that browsers andcrawlers often request:

import re
IGNORABLE_404_URLS = [
    re.compile(r'^/apple-touch-icon.*\.png$'),
    re.compile(r'^/favicon\.ico$'),
    re.compile(r'^/robots\.txt$'),
]

(Note that these are regular expressions, so we put a backslash in front ofperiods to escape them.)

If you'd like to customize the behavior ofdjango.middleware.common.BrokenLinkEmailsMiddleware further (forexample to ignore requests coming from web crawlers), you should subclass itand override its methods.

参见

404 errors are logged using the logging framework. By default, these logrecords are ignored, but you can use them for error reporting by writing ahandler and configuring logging appropriately.

Filtering error reports

警告

Filtering sensitive data is a hard problem, and it's nearly impossible toguarantee that sensitive data won't leak into an error report. Therefore,error reports should only be available to trusted team members and youshould avoid transmitting error reports unencrypted over the Internet(such as through email).

Filtering sensitive information

Error reports are really helpful for debugging errors, so it is generallyuseful to record as much relevant information about those errors as possible.For example, by default Django records the full traceback for theexception raised, each traceback frame’s local variables, and theHttpRequest’s attributes.

However, sometimes certain types of information may be too sensitive and thusmay not be appropriate to be kept track of, for example a user's password orcredit card number. So in addition to filtering out settings that appear to besensitive as described in the DEBUG documentation, Django offers aset of function decorators to help you control which information should befiltered out of error reports in a production environment (that is, whereDEBUG is set to False): sensitive_variables() andsensitive_post_parameters().

sensitivevariables(*variables_)[源代码]
If a function (either a view or any regular callback) in your code useslocal variables susceptible to contain sensitive information, you mayprevent the values of those variables from being included in error reportsusing the sensitive_variables decorator:

from django.views.decorators.debug import sensitive_variables
 
@sensitive_variables('user', 'pw', 'cc')
def process_info(user):
    pw = user.pass_word
    cc = user.credit_card_number
    name = user.name
    ...

In the above example, the values for the user, pw and ccvariables will be hidden and replaced with stars (**) in theerror reports, whereas the value of the name variable will bedisclosed.

To systematically hide all local variables of a function from error logs,do not provide any argument to the sensitive_variables decorator:

@sensitive_variables()
def my_function():
    …

When using multiple decorators

If the variable you want to hide is also a function argument (e.g.'user’ in the following example), and if the decorated function hasmultiple decorators, then make sure to place @sensitive_variablesat the top of the decorator chain. This way it will also hide thefunction argument as it gets passed through the other decorators:

@sensitive_variables('user', 'pw', 'cc')
@some_decorator
@another_decorator
def process_info(user):
    …

sensitivepost_parameters(*parameters_)[源代码]
If one of your views receives an HttpRequest objectwith POST parameters susceptible tocontain sensitive information, you may prevent the values of thoseparameters from being included in the error reports using thesensitive_post_parameters decorator:

from django.views.decorators.debug import sensitive_post_parameters
 
@sensitive_post_parameters('pass_word', 'credit_card_number')
def record_user_profile(request):
    UserProfile.create(
        user=request.user,
        password=request.POST['pass_word'],
        credit_card=request.POST['credit_card_number'],
        name=request.POST['name'],
    )
    ...

In the above example, the values for the password andcredit_card_number POST parameters will be hidden and replaced withstars (**_) in the request's representation inside the errorreports, whereas the value of the name parameter will be disclosed.

To systematically hide all POST parameters of a request in error reports,do not provide any argument to the sensitive_post_parameters decorator:

@sensitive_post_parameters()
def my_view(request):
    …

All POST parameters are systematically filtered out of error reports forcertain django.contrib.auth.views views (login,password_reset_confirm, password_change, and add_view anduser_change_password in the auth admin) to prevent the leaking ofsensitive information such as user passwords.

Custom error reports

All sensitive_variables() and sensitive_post_parameters() do is,respectively, annotate the decorated function with the names of sensitivevariables and annotate the HttpRequest object with the names of sensitivePOST parameters, so that this sensitive information can later be filtered outof reports when an error occurs. The actual filtering is done by Django'sdefault error reporter filter:django.views.debug.SafeExceptionReporterFilter. This filter uses thedecorators' annotations to replace the corresponding values with stars(**) when the error reports are produced. If you wish to override orcustomize this default behavior for your entire site, you need to define yourown filter class and tell Django to use it via theDEFAULT_EXCEPTION_REPORTER_FILTER setting:

DEFAULT_EXCEPTION_REPORTER_FILTER = 'path.to.your.CustomExceptionReporterFilter'

You may also control in a more granular way which filter to use within anygiven view by setting the HttpRequest’s exception_reporter_filterattribute:

def my_view(request):
    if request.user.is_authenticated:
        request.exception_reporter_filter = CustomExceptionReporterFilter()
    ...

Your custom filter class needs to inherit fromdjango.views.debug.SafeExceptionReporterFilter and may override thefollowing methods:

class SafeExceptionReporterFilter[源代码]
SafeExceptionReporterFilter.isactive(_request)[源代码]
Returns True to activate the filtering operated in the other methods.By default the filter is active if DEBUG is False.
SafeExceptionReporterFilter.getpost_parameters(_request)[源代码]
Returns the filtered dictionary of POST parameters. By default it replacesthe values of sensitive parameters with stars (**).
SafeExceptionReporterFilter.gettraceback_frame_variables(_request, tb_frame)[源代码]
Returns the filtered dictionary of local variables for the given tracebackframe. By default it replaces the values of sensitive variables with stars(**).

参见

You can also set up custom error reporting by writing a custom piece ofexception middleware. If you do write customerror handling, it's a good idea to emulate Django's built-in error handlingand only report/log errors if DEBUG is False.