pythonDjango文档说，这是一种不安全的静态文件服务方式，是真的吗？如果是，怎么会这样？

Question

我遵循this的方式传递静态文件，但根据上面的免责声明，这既不安全又低效。是真的吗？我该怎么做呢？在

另外，还有一个半脱题的问题：“媒体”和“静态文件”在web编程环境中是否可以互换？我经常看到他们到处乱扔，他们似乎指的是同一件事。在

Answer 1

it's both insecure and inefficient. Is it true?

当然。你觉得他们为什么这么说？在

How should I be doing it instead?

这就是Apache的目的。或是gingx或lighttpd或其他大量的web服务器。在

Are the terms 'media' and 'static files' interchangeable in the context of web programming?

通常。在

django1.3确实区分了上传和下载的“媒体”和静态的静态文件。在

Answer 2

同意S.Lott的回答，但是当你质疑这是一种不安全的静态文件服务方式时，这是真的吗？

我想有必要解释一下为什么。在

The answer of Why serve static files from django is insecure解释了原因。此处引用：

Nothing can be considered secure unless it is designed and audited for security. We have done neither with the static file server. It may not have existing security holes, but it should not be considered secure because that's not a design goal.

For example, a secure file server would need to check for resource allocation problems so that serving a very large file didn't constitute a denial-of-service attack. That requires a lot of extra code and pipeline management which isn't worth putting into something that's just for development purposes.