Tornado 4.0.1 框架指南：异步网络编程与Web应用

需积分: 10 92 浏览量更新于2024-07-23 收藏 623KB PDF 举报

"Tornado 4.0.1 Python 框架指南，包含了用户指南、核心Web框架和异步网络编程等内容，详细讲解了Tornado的特性与使用方法。" Tornado是一个用Python编写的高性能、异步网络库，特别适合处理大量并发连接，如实时Web服务和长轮询。在4.0.1版本中，它提供了丰富的功能和改进，以优化Web应用的性能和可维护性。 1. **用户指南** - **介绍**：Tornado是一个轻量级且高效的Web服务器和框架，它支持非阻塞I/O，能够处理高并发场景。 - **异步和非阻塞I/O**：Tornado的核心是其非阻塞I/O模型，这使得服务器可以同时处理多个请求，而无需等待某个请求完成再处理下一个。 - **协程(Coroutines)**：Tornado支持Python的协程，允许开发者编写更直观的异步代码，而无需嵌套回调函数。 - **Tornado Web应用结构**：一个典型的Tornado应用由`RequestHandler`和`Application`类构成，它们定义了路由和请求处理逻辑。 - **模板和UI**：Tornado提供了一个灵活的模板系统，方便生成HTML和其他输出格式。 - **认证和安全**：Tornado包含基础的认证和安全机制，如HTTP基本认证，帮助开发者保护Web应用的安全。 - **运行与部署**：指南涵盖了如何运行和部署Tornado应用，包括设置服务器、配置和错误处理。 2. **核心Web框架** - **tornado.web**：包含`RequestHandler`和`Application`类，用于处理HTTP请求和构建Web应用。 - **tornado.httpserver**：提供了一个非阻塞的HTTP服务器，它可以与其他Tornado组件配合，实现高效的异步服务。 - **tornado.template**：用于生成动态内容的模板引擎，支持多种模板语言和自定义模板加载器。 - **tornado.escape**：提供了字符串转义和处理工具，用于防止XSS等安全问题。 - **tornado.locale**：支持国际化的模块，可以处理不同地区的语言和日期格式。 3. **异步网络编程** - **tornado.gen**：简化异步代码的模块，通过装饰器和yield关键字，将回调转换为线性代码。 - **tornado.ioloop**：主事件循环，是异步操作的核心，管理定时器、文件描述符监听等。 - **tornado.iostream**：非阻塞套接字的包装器，提供了读写操作的抽象层。 - **tornado.http1connection**：实现了HTTP/1.x客户端/服务器协议，支持异步HTTP通信。 - **tornado.httpclient**：异步HTTP客户端，可以发起HTTP请求并处理响应。 - **tornado.netutil**：包含各种网络辅助工具，如多进程和多线程的支持。 - **tornado.tcpclient**：IOStream连接工厂，用于创建TCP客户端连接。 - **tornado.tcpserver**：基础TCP服务器，可以处理TCP连接，并与Tornado的其他组件集成。这份指南详细介绍了Tornado框架的各个方面，对于想要构建高效、异步的Python Web应用的开发者来说，是一份宝贵的参考资料。通过学习和实践，开发者可以利用Tornado的强大功能构建出高性能的实时Web应用。

Tornado Documentation, Release 4.0b3

1.5.3 Internationalization

The locale of the current user (whether they are logged in or not) is always available as self.locale in the request

handler and as locale in templates. The name of the locale (e.g., en_US) is available as locale.name, and

you can translate strings with the Locale.translate method. Templates also have the global function call _()

available for string translation. The translate function has two forms:

_("Translate this string")

which translates the string directly based on the current locale, and:

_("A person liked this", "%(num)d people liked this",

len(people)) % {"num": len(people)}

which translates a string that can be singular or plural based on the value of the third argument. In the example above,

a translation of the ﬁrst string will be returned if len(people) is 1, or a translation of the second string will be

returned otherwise.

The most common pattern for translations is to use Python named placeholders for variables (the %(num)d in the

example above) since placeholders can move around on translation.

Here is a properly internationalized template:

<html>

<head>

<title>FriendFeed - {{ _("Sign in") }}</title>

</head>

<body>

<div>{{ _("Username") }} <input type="text" name="username"/></div>

<div>{{ _("Password") }} <input type="password" name="password"/></div>

{% module xsrf_form_html() %}

</form>

</body>

</html>

By default, we detect the user’s locale using the Accept-Language header sent by the user’s browser. We choose

en_US if we can’t ﬁnd an appropriate Accept-Language value. If you let user’s set their locale as a preference,

you can override this default locale selection by overriding RequestHandler.get_user_locale:

class BaseHandler(tornado.web.RequestHandler):

def get_current_user(self):

user_id = self.get_secure_cookie("user")

if not user_id: return None

return self.backend.get_user_by_id(user_id)

def get_user_locale(self):

if "locale" not in self.current_user.prefs:

# Use the Accept-Language header

return None

return self.current_user.prefs["locale"]

If get_user_locale returns None, we fall back on the Accept-Language header.

The tornado.locale module supports loading translations in two formats: the .mo format used by

gettext and related tools, and a simple .csv format. An application will generally call either

tornado.locale.load_translations or tornado.locale.load_gettext_translations once

at startup; see those methods for more details on the supported formats..

12 Chapter 1. User’s guide

Tornado Documentation, Release 4.0b3

You can get the list of supported locales in your application with tornado.locale.get_supported_locales().

The user’s locale is chosen to be the closest match based on the supported locales. For example, if the user’s locale

is es_GT, and the es locale is supported, self.locale will be es for that request. We fall back on en_US if no

close match can be found.

1.5.4 UI modules

Tornado supports UI modules to make it easy to support standard, reusable UI widgets across your application. UI

modules are like special function calls to render components of your page, and they can come packaged with their

own CSS and JavaScript.

For example, if you are implementing a blog, and you want to have blog entries appear on both the blog home page

and on each blog entry page, you can make an Entry module to render them on both pages. First, create a Python

module for your UI modules, e.g., uimodules.py:

class Entry(tornado.web.UIModule):

def render(self, entry, show_comments=False):

return self.render_string(

"module-entry.html", entry=entry, show_comments=show_comments)

Tell Tornado to use uimodules.py using the ui_modules setting in your application:

from . import uimodules

class HomeHandler(tornado.web.RequestHandler):

def get(self):

entries = self.db.query("SELECT

FROM entries ORDER BY date DESC")

self.render("home.html", entries=entries)

class EntryHandler(tornado.web.RequestHandler):

def get(self, entry_id):

entry = self.db.get("SELECT

FROM entries WHERE id = %s", entry_id)

if not entry: raise tornado.web.HTTPError(404)

self.render("entry.html", entry=entry)

settings = {

"ui_modules": uimodules,

}

application = tornado.web.Application([

(r"/", HomeHandler),

(r"/entry/([0-9]+)", EntryHandler),

settings)

Within a template, you can call a module with the {% module %} statement. For example, you could call the

Entry module from both home.html:

{% for entry in entries %}

{% module Entry(entry) %}

{% end %}

and entry.html:

{% module Entry(entry, show_comments=True) %}

Modules can include custom CSS and JavaScript functions by overriding the embedded_css,

embedded_javascript, javascript_files, or css_files methods:

1.5. Templates and UI 13

Tornado Documentation, Release 4.0b3

class Entry(tornado.web.UIModule):

def embedded_css(self):

return ".entry { margin-bottom: 1em; }"

def render(self, entry, show_comments=False):

return self.render_string(

"module-entry.html", show_comments=show_comments)

Module CSS and JavaScript will be included once no matter how many times a module is used on a page. CSS is

always included in the <head> of the page, and JavaScript is always included just before the </body> tag at the end

of the page.

When additional Python code is not required, a template ﬁle itself may be used as a module. For example, the preceding

example could be rewritten to put the following in module-entry.html:

{{ set_resources(embedded_css=".entry { margin-bottom: 1em; }") }}

This revised template module would be invoked with:

{% module Template("module-entry.html", show_comments=True) %}

The set_resources function is only available in templates invoked via {% module Template(...) %}.

Unlike the {% include ... %} directive, template modules have a distinct namespace from their containing

template - they can only see the global template namespace and their own keyword arguments.

1.6 Authentication and security

1.6.1 Cookies and secure cookies

You can set cookies in the user’s browser with the set_cookie method:

class MainHandler(tornado.web.RequestHandler):

def get(self):

if not self.get_cookie("mycookie"):

self.set_cookie("mycookie", "myvalue")

self.write("Your cookie was not set yet!")

else:

self.write("Your cookie was set!")

Cookies are not secure and can easily be modiﬁed by clients. If you need to set cookies to, e.g., identify the cur-

rently logged in user, you need to sign your cookies to prevent forgery. Tornado supports signed cookies with the

set_secure_cookie and get_secure_cookie methods. To use these methods, you need to specify a secret

key named cookie_secret when you create your application. You can pass in application settings as keyword

arguments to your application:

application = tornado.web.Application([

(r"/", MainHandler),

], cookie_secret="__TODO:_GENERATE_YOUR_OWN_RANDOM_VALUE_HERE__")

Signed cookies contain the encoded value of the cookie in addition to a timestamp and an HMAC signature. If the

cookie is old or if the signature doesn’t match, get_secure_cookie will return None just as if the cookie isn’t

set. The secure version of the example above:

class MainHandler(tornado.web.RequestHandler):

def get(self):

14 Chapter 1. User’s guide

Tornado Documentation, Release 4.0b3

if not self.get_secure_cookie("mycookie"):

self.set_secure_cookie("mycookie", "myvalue")

self.write("Your cookie was not set yet!")

else:

self.write("Your cookie was set!")

Tornado’s secure cookies guarantee integrity but not conﬁdentiality. That is, the cookie cannot be modiﬁed but its

contents can be seen by the user. The cookie_secret is a symmetric key and must be kept secret – anyone who

obtains the value of this key could produce their own signed cookies.

By default, Tornado’s secure cookies expire after 30 days. To change this, use the expires_days keyword argument

to set_secure_cookie and the max_age_days argument to set_secure_cookie. These two values are

passed separately so that you may e.g. have a cookie that is valid for 30 days for most purposes, but for certain sensitive

actions (such as changing billing information) you use a smaller max_age_days when reading the cookie.

1.6.2 User authentication

The currently authenticated user is available in every request handler as self.current_user, and in every tem-

plate as current_user. By default, current_user is None.

To implement user authentication in your application, you need to override the get_current_user() method in

your request handlers to determine the current user based on, e.g., the value of a cookie. Here is an example that lets

users log into the application simply by specifying a nickname, which is then saved in a cookie:

class BaseHandler(tornado.web.RequestHandler):

def get_current_user(self):

return self.get_secure_cookie("user")

class MainHandler(BaseHandler):

def get(self):

if not self.current_user:

self.redirect("/login")

return

name = tornado.escape.xhtml_escape(self.current_user)

self.write("Hello, " + name)

class LoginHandler(BaseHandler):

def get(self):

self.write(’<html><body><form action="/login" method="post">’

’Name: <input type="text" name="name">’

’<input type="submit" value="Sign in">’

’</form></body></html>’)

def post(self):

self.set_secure_cookie("user", self.get_argument("name"))

self.redirect("/")

application = tornado.web.Application([

(r"/", MainHandler),

(r"/login", LoginHandler),

], cookie_secret="__TODO:_GENERATE_YOUR_OWN_RANDOM_VALUE_HERE__")

You can require that the user be logged in using the Python decorator tornado.web.authenticated. If a

request goes to a method with this decorator, and the user is not logged in, they will be redirected to login_url

(another application setting). The example above could be rewritten:

1.6. Authentication and security 15

Tornado Documentation, Release 4.0b3

class MainHandler(BaseHandler):

@tornado.web.authenticated

def get(self):

name = tornado.escape.xhtml_escape(self.current_user)

self.write("Hello, " + name)

settings = {

"cookie_secret": "__TODO:_GENERATE_YOUR_OWN_RANDOM_VALUE_HERE__",

"login_url": "/login",

}

application = tornado.web.Application([

(r"/", MainHandler),

(r"/login", LoginHandler),

settings)

If you decorate post() methods with the authenticated decorator, and the user is not logged in,

the server will send a 403 response. The @authenticated decorator is simply shorthand for if not

self.current_user: self.redirect() and may not be appropriate for non-browser-based login

schemes.

Check out the Tornado Blog example application for a complete example that uses authentication (and stores user data

in a MySQL database).

1.6.3 Third party authentication

The tornado.auth module implements the authentication and authorization protocols for a number of the most

popular sites on the web, including Google/Gmail, Facebook, Twitter, and FriendFeed. The module includes methods

to log users in via these sites and, where applicable, methods to authorize access to the service so you can, e.g.,

download a user’s address book or publish a Twitter message on their behalf.

Here is an example handler that uses Google for authentication, saving the Google credentials in a cookie for later

access:

class GoogleHandler(tornado.web.RequestHandler, tornado.auth.GoogleMixin):

@tornado.web.asynchronous

def get(self):

if self.get_argument("openid.mode", None):

self.get_authenticated_user(self._on_auth)

return

self.authenticate_redirect()

def _on_auth(self, user):

if not user:

self.authenticate_redirect()

return

# Save the user with, e.g., set_secure_cookie()

See the tornado.auth module documentation for more details.

1.6.4 Cross-site request forgery protection

Cross-site request forgery, or XSRF, is a common problem for personalized web applications. See the Wikipedia

article for more information on how XSRF works.

The generally accepted solution to prevent XSRF is to cookie every user with an unpredictable value and include that

value as an additional argument with every form submission on your site. If the cookie and the value in the form

16 Chapter 1. User’s guide

剩余158页未读，继续阅读

linkedin_20809253

粉丝: 0
资源: 3

Tornado 4.0.1 框架指南：异步网络编程与Web应用

tornado（python）实现样例代码.

tcp_server_honorus2_pythonTCP_tcp_tornado_pythonserver_

nats.py2:用于 NATS 的基于 Tornado 的 Python 2 客户端

async_pubsub:使用 Redis、ZMQ、Tornado 在 Python 中异步发布订阅

龙卷风：Tornado是Python网络框架和异步网络库，最初由FriendFeed开发

tornado2-UserGuide

Tornado user's Guide.pdf

Tornado user's guide 2.2 (windows)

tornado python框架

tornado_users_guide_windows_2.2.pdf

最新资源