What this prompt does
This prompt generates a set of custom Django middleware for a [project_type], covering the cross-cutting concerns named in [middleware_purpose]. It builds request logging that captures method, path, authenticated user, client IP (respecting X-Forwarded-For from [proxy_setup]), request body size, response status, and response time in milliseconds, written in [log_format] to [log_destination].
It also produces a rate limiter backed by [rate_limit_backend] that caps authenticated users at [auth_rate_limit] and anonymous users at [anon_rate_limit], returns 429 with a Retry-After header, and skips [rate_limit_exclusions]. A [tenant_strategy] multi-tenancy middleware resolves the tenant from [tenant_identifier], sets request.tenant for downstream use, and rejects invalid tenants with a 404. A security-headers middleware adds X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, a CSP tuned for [csp_policy], and Permissions-Policy, while a performance monitor emits p50/p95/p99 metrics to [metrics_backend] grouped by endpoint pattern to avoid cardinality explosion. Crucially, it explains MIDDLEWARE ordering and ships unit tests per middleware.
When to use it
- You need request auditing logged consistently across every endpoint
- You want rate limiting that distinguishes authenticated from anonymous traffic
- You're building multi-tenant routing and need tenant resolved early in the stack
- You want security headers applied globally rather than per-view
- You need latency percentiles per endpoint without blowing up metric cardinality
- You want middleware that ships with RequestFactory and test-client unit tests
- You're inheriting a project and want these concerns centralized instead of scattered across views
Example output
The AI returns several middleware classes, each as its own code block, plus a MIDDLEWARE list showing the correct order with comments explaining why each sits where it does. Expect a 429 response example with a Retry-After header, a CSP header string for [csp_policy], a structured [log_format] log line, and unit tests using Django's test client and RequestFactory for each component so you can verify behavior before wiring them in. The ordering comments in the MIDDLEWARE list double as documentation for the next engineer who touches the stack.
Pro tips
- Be precise about
[proxy_setup]so X-Forwarded-For parsing picks the right client IP and isn't spoofable behind your real proxy chain - Set
[auth_rate_limit]and[anon_rate_limit]to genuinely different values — anonymous traffic usually warrants a much tighter cap - List
[rate_limit_exclusions]carefully so health checks and webhook receivers never get throttled - Keep performance metrics grouped by endpoint pattern, not exact URL, or
[metrics_backend]cardinality will explode - Pay attention to the ordering explanation — tenant resolution must run before anything that reads
request.tenant - Apply security headers in the response phase so they cover error responses too, not just successful ones
- Exclude
[rate_limit_exclusions]before counting a request so a health-check probe never consumes a rate-limit token - If the CSP feels too permissive, re-prompt with the exact sources you allow for
[csp_policy]
