Snippet

Custom Middleware for Restricting HTTP Request Methods

Django middleware components intercept requests before they reach views. Implementing method inspection in callable middleware provides central application security enforcement against forbidden HTTP verbs.

snippet.py

python

from typing import Callable
from django.http import HttpRequest, HttpResponse, HttpResponseNotAllowed
 
class RestrictHttpMethodsMiddleware:
    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]) -> None:
        self.get_response = get_response
        self.disallowed_methods = {"TRACE", "CONNECT"}
 
    def __call__(self, request: HttpRequest) -> HttpResponse:
        if request.method in self.disallowed_methods:
            return HttpResponseNotAllowed(list(self.disallowed_methods))
        return self.get_response(request)

django

Breakdown

class RestrictHttpMethodsMiddleware:

Declares a class-based Django middleware using the standardCallable structure.

def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]) -> None:

Initializes the middleware instance receiving the next handler in the request chain.

def __call__(self, request: HttpRequest) -> HttpResponse:

Drives per-request execution when the request travels through the middleware stack.

if request.method in self.disallowed_methods:

Checks whether the incoming request HTTP verb matches restricted operations like TRACE or CONNECT.

return HttpResponseNotAllowed(list(self.disallowed_methods))

Short-circuits request handling and responds with an HTTP 405 error if an illegal method is used.

Previous snippet Next snippet

More Intermediate Python exercises →

Custom Middleware for Restricting HTTP Request Methods

Related