中间件是 Django 请求/响应处理的钩子框架。它是一个轻量级的、低级的“插件”系统，用于全局改变 Django 的输入或输出。
\n每个中间件组件负责做一些特定的功能。例如，Django 包含一个中间件组件 AuthenticationMiddleware，它使用会话将用户与请求关联起来。
他的文档解释了中间件是如何工作的，如何激活中间件，以及如何编写自己的中间件。Django 具有一些内置的中间件，你可以直接使用。它们被记录在 built-in middleware reference 中。
\n中间件工厂是一个可调用的程序，它接受 get_response 可调用并返回中间件。中间件是可调用的，它接受请求并返回响应，就像视图一样。
中间件可以被写成这样的函数：
\ndef simple_middleware(get_response):\n # One-time configuration and initialization.\n\n def middleware(request):\n # Code to be executed for each request before\n # the view (and later middleware) are called.\n\n response = get_response(request)\n\n # Code to be executed for each request/response after\n # the view is called.\n\n return response\n\n return middleware\n或者它可以写成一个类，它的实例是可调用的，如下：
\nclass SimpleMiddleware:\n def __init__(self, get_response):\n self.get_response = get_response\n # One-time configuration and initialization.\n\n def __call__(self, request):\n # Code to be executed for each request before\n # the view (and later middleware) are called.\n\n response = self.get_response(request)\n\n # Code to be executed for each request/response after\n # the view is called.\n\n return response\nDjango 提供的 get_response 响应可能是实际视图（如果这是最后列出的中间件），或者它可能是链中的下一个中间件。不需要知道或关心当前的中间件到底是什么，它只是代表了下一步的内容。
以上是一个轻微的简化——链中最后一个中间件调用的 get_response 可不是实际视图，而是处理程序的包装方法，它负责应用 view middleware，调用具有适当URL参数的视图，并应用 template-response 和 exception 中间件。
中间件可以放在 Python 路径上的任何地方。
\n__init__(get_response)Link to this heading#中间件工厂必须接受 get_response 参数。还可以初始化中间件的一些全局状态。记住两个注意事项：
Django仅用 get_response 参数初始化您的中间件，因此不能定义 __init__() ，因为需要其他参数。
与每次请求调用 __call__() 方法不同，当 Web 服务器启动时，__init__() 只被称为*一次*。
在启动时确定是否应该使用一个中间件有时是有用的。在这些情况下，您的中间件的 __init__() 方法可能会引发 MiddlewareNotUsed。Django 将从中间件进程中删除该中间件，并将调试消息记录到 django.request 日志：设置 DEBUG 为 True。
若要激活中间件组件，请将其添加到 Django 设置中的 MIDDLEWARE 列表中。
在 MIDDLEWARE 中，每个中间件组件由字符串表示：指向中间件工厂的类或函数名的完整 Python 路径。例如，这里创建的默认值是 django-admin startproject：
MIDDLEWARE = [\n 'django.middleware.security.SecurityMiddleware',\n 'django.contrib.sessions.middleware.SessionMiddleware',\n 'django.middleware.common.CommonMiddleware',\n 'django.middleware.csrf.CsrfViewMiddleware',\n 'django.contrib.auth.middleware.AuthenticationMiddleware',\n 'django.contrib.messages.middleware.MessageMiddleware',\n 'django.middleware.clickjacking.XFrameOptionsMiddleware',\n]\nDjango 安装不需要任何中间件——如果您愿意的话，MIDDLEWARE 可以为空——但是强烈建议您至少使用 CommonMiddleware。
MIDDLEWARE 的顺序很重要，因为中间件会依赖其他中间件。例如：类 AuthenticationMiddleware 在会话中存储经过身份验证的用户；因此，它必须在 SessionMiddleware 后面运行 。中间件。Session中间件。请参阅 Middleware ordering ，用于一些关于 Django 中间件类排序的常见提示。
在请求阶段，在调用视图之前，Django 按照定义的顺序应用中间件 MIDDLEWARE，自顶向下。
你可以把它想象成一个洋葱：每个中间件类都是一个“层”，它覆盖了洋葱的核心。如果请求通过洋葱的所有层（每一个调用 get_response ）以将请求传递到下一层，一直到内核的视图，那么响应将在返回的过程中通过每个层（以相反的顺序）。
If one of the layers decides to short-circuit and return a response without\never calling its get_response, none of the layers of the onion inside that\nlayer (including the view) will see the request or the response. The response\nwill only return through the same layers that the request passed in through.
Besides the basic request/response middleware pattern described earlier, you\ncan add three other special methods to class-based middleware:
\nprocess_view()Link to this heading#request is an HttpRequest object. view_func is\nthe Python function that Django is about to use. (It's the actual function\nobject, not the name of the function as a string.) view_args is a list of\npositional arguments that will be passed to the view, and view_kwargs is a\ndictionary of keyword arguments that will be passed to the view. Neither\nview_args nor view_kwargs include the first view argument\n(request).
process_view() is called just before Django calls the view.
It should return either None or an HttpResponse\nobject. If it returns None, Django will continue processing this request,\nexecuting any other process_view() middleware and, then, the appropriate\nview. If it returns an HttpResponse object, Django won't\nbother calling the appropriate view; it'll apply response middleware to that\nHttpResponse and return the result.
process_exception()Link to this heading#request is an HttpRequest object. exception is an\nException object raised by the view function.
Django calls process_exception() when a view raises an exception.\nprocess_exception() should return either None or an\nHttpResponse object. If it returns an\nHttpResponse object, the template response and response\nmiddleware will be applied and the resulting response returned to the\nbrowser. Otherwise, default exception handling kicks in.
Again, middleware are run in reverse order during the response phase, which\nincludes process_exception. If an exception middleware returns a response,\nthe process_exception methods of the middleware classes above that\nmiddleware won't be called at all.
process_template_response()Link to this heading#request is an HttpRequest object. response is\nthe TemplateResponse object (or equivalent)\nreturned by a Django view or by a middleware.
process_template_response() is called just after the view has finished\nexecuting, if the response instance has a render() method, indicating that\nit is a TemplateResponse or equivalent.
It must return a response object that implements a render method. It could\nalter the given response by changing response.template_name and\nresponse.context_data, or it could create and return a brand-new\nTemplateResponse or equivalent.
You don't need to explicitly render responses -- responses will be\nautomatically rendered once all template response middleware has been\ncalled.
\nMiddleware are run in reverse order during the response phase, which\nincludes process_template_response().
Unlike HttpResponse,\nStreamingHttpResponse does not have a content\nattribute. As a result, middleware can no longer assume that all responses\nwill have a content attribute. If they need access to the content, they\nmust test for streaming responses and adjust their behavior accordingly:
if response.streaming:\n response.streaming_content = wrap_streaming_content(response.streaming_content)\nelse:\n response.content = alter_content(response.content)\nDjango automatically converts exceptions raised by the view or by middleware\ninto an appropriate HTTP response with an error status code. Certain\nexceptions are converted to 4xx status codes, while an unknown\nexception is converted to a 500 status code.
\nThis conversion takes place before and after each middleware (you can think of\nit as the thin film in between each layer of the onion), so that every\nmiddleware can always rely on getting some kind of HTTP response back from\ncalling its get_response callable. Middleware don't need to worry about\nwrapping their call to get_response in a try/except and handling an\nexception that might have been raised by a later middleware or the view. Even\nif the very next middleware in the chain raises an\nHttp404 exception, for example, your middleware won't see\nthat exception; instead it will get an HttpResponse\nobject with a status_code of 404.
Django provides django.utils.deprecation.MiddlewareMixin to ease creating\nmiddleware classes that are compatible with both MIDDLEWARE and the\nold MIDDLEWARE_CLASSES. All middleware classes included with Django\nare compatible with both settings.
The mixin provides an __init__() method that accepts an optional\nget_response argument and stores it in self.get_response.
The __call__() method:
Calls self.process_request(request) (if defined).
Calls self.get_response(request) to get the response from later\nmiddleware and the view.
Calls self.process_response(request, response) (if defined).
Returns the response.
If used with MIDDLEWARE_CLASSES, the __call__() method will\nnever be used; Django calls process_request() and process_response()\ndirectly.
In most cases, inheriting from this mixin will be sufficient to make an\nold-style middleware compatible with the new system with sufficient\nbackwards-compatibility. The new short-circuiting semantics will be harmless or\neven beneficial to the existing middleware. In a few cases, a middleware class\nmay need some changes to adjust to the new semantics.
\nThese are the behavioral differences between using MIDDLEWARE and\nMIDDLEWARE_CLASSES:
Under MIDDLEWARE_CLASSES, every middleware will always have its\nprocess_response method called, even if an earlier middleware\nshort-circuited by returning a response from its process_request\nmethod. Under MIDDLEWARE, middleware behaves more like an onion:\nthe layers that a response goes through on the way out are the same layers\nthat saw the request on the way in. If a middleware short-circuits, only\nthat middleware and the ones before it in MIDDLEWARE will see the\nresponse.
Under MIDDLEWARE_CLASSES, process_exception is applied to\nexceptions raised from a middleware process_request method. Under\nMIDDLEWARE, process_exception applies only to exceptions\nraised from the view (or from the render method of a\nTemplateResponse). Exceptions raised from\na middleware are converted to the appropriate HTTP response and then passed\nto the next middleware.
Under MIDDLEWARE_CLASSES, if a process_response method raises\nan exception, the process_response methods of all earlier middleware are\nskipped and a 500 Internal Server Error HTTP response is always\nreturned (even if the exception raised was e.g. an\nHttp404). Under MIDDLEWARE, an exception\nraised from a middleware will immediately be converted to the appropriate\nHTTP response, and then the next middleware in line will see that\nresponse. Middleware are never skipped due to a middleware raising an\nexception.