基于Django实现不暴露URL的互联网文件（含音频）网站服务咨询

Hey there! Let's break down how to solve both of your Django file-serving problems—since they both boil down to using Django as a secure middleman to hide the original file source (super important when that source has sensitive API keys).

Instead of letting your frontend hit the original file URL directly, your users will request the file from a Django view. That view will fetch the file from the hidden source (using your server's credentials/API keys), then stream it back to the user. This way, the original URL (and any secrets in it) never leaves your backend.

Scenario 1: Serving a General File Without Exposing Its Source #

Here's a straightforward view that fetches and streams any file from a hidden URL:

import requests
from django.http import StreamingHttpResponse, HttpResponse
from django.views.decorators.http import require_GET

@require_GET
def serve_proxied_file(request):
    # This is the secret source URL—never share this with frontend!
    source_url = "https://example.com/your-hidden-file.pdf"

    try:
        # Fetch the file in streaming mode to avoid loading the whole thing into memory
        source_response = requests.get(source_url, stream=True, timeout=10)
        source_response.raise_for_status()  # Catch HTTP errors (404, 500, etc.)
    except requests.exceptions.RequestException as e:
        return HttpResponse(f"Failed to retrieve file: {str(e)}", status=500)

    # Pass through the original content type so browsers handle it correctly
    content_type = source_response.headers.get('Content-Type', 'application/octet-stream')

    # Stream the content to the user
    return StreamingHttpResponse(
        source_response.iter_content(chunk_size=8192),  # 8KB chunks are a safe default
        content_type=content_type,
        status=source_response.status_code
    )

Scenario 2: Serving Audio Files With a Hidden API Key #

For URLs that include sensitive API keys, we'll store the key securely in Django settings (never hardcode it!) and build the source URL server-side:

First, Store Your API Key Securely #

In your settings.py (use environment variables for production—never commit this to version control!):

# Install python-dotenv to load these from a .env file in production
AUDIO_SERVICE_API_KEY = "your-secret-api-key-here"

Then, Build the Proxy View #

import requests
from django.conf import settings
from django.http import StreamingHttpResponse, HttpResponse
from django.views.decorators.http import require_GET

@require_GET
def serve_protected_audio(request):
    # Build the source URL with your secret API key (hidden from users)
    source_url = f"https://audio-api.example.com/stream?api_key={settings.AUDIO_SERVICE_API_KEY}"

    # Add any required headers the audio API expects (e.g., User-Agent)
    request_headers = {
        "User-Agent": "Django Audio Proxy"
    }

    try:
        source_response = requests.get(source_url, stream=True, headers=request_headers, timeout=15)
        source_response.raise_for_status()
    except requests.exceptions.RequestException as e:
        return HttpResponse(f"Failed to fetch audio: {str(e)}", status=500)

    # Set the correct audio content type (adjust based on your file type: audio/mpeg for MP3, audio/wav for WAV, etc.)
    content_type = source_response.headers.get('Content-Type', 'audio/mpeg')

    # Stream the audio to the frontend
    return StreamingHttpResponse(
        source_response.iter_content(chunk_size=8192),
        content_type=content_type,
        status=source_response.status_code
    )

Map the View to a URL #

Add these paths to your app's urls.py so users can access the proxied files:

from django.urls import path
from .views import serve_proxied_file, serve_protected_audio

urlpatterns = [
    # For general proxied files
    path('files/proxied/', serve_proxied_file, name='serve_proxied_file'),
    # For protected audio streams
    path('audio/stream/', serve_protected_audio, name='serve_protected_audio'),
]

Pro Tips for Production #

• Cache Frequently Used Files: Add cache headers to reduce repeated requests to the source. For example:

  streaming_response = StreamingHttpResponse(...)
  streaming_response['Cache-Control'] = 'public, max-age=86400'  # Cache for 1 day
  

• Rate Limiting: Use packages like django-ratelimit to prevent abuse of your proxy endpoint.
• Use Environment Variables: For production, store API keys and source URLs in environment variables (with python-dotenv) instead of hardcoding them in settings.
• Handle Large Files: StreamingHttpResponse is critical here—it sends the file in chunks instead of loading the entire file into server memory.

内容的提问来源于stack exchange，提问作者Shubham Chaudhary