认证组件
认证简介
作用:校验是否登录
- 首先定义一个类,集成BaseAuthentication,写一个方法:authenticate，在方法内部，实证过程，认证通过，返回None或者两个对象（user，auth），这两个对象，在视图类的request中可以取出来.如果返回的是None，就走下一个认证组件 [xx,xxx]
from rest_framework.authentication import BaseAuthentication
class myAuthen(BaseAuthentication):
def authenticate(self, request):
token = request.query_params.get('token')
ret = models.UserToken.objects.filter(token=token).first()
if ret:
# return ret.user, ret
# 要写多个认证类，这个地返回None
# 最后一个认证类，返回这俩值
return ret.user, ret
else:
raise AuthenticationFailed('您没有登陆')
- 局部使用:只需要在视图类中加入(可以写多个)
authentication_classes = [myAuthen, ]
- 全局使用 setting中设置
REST_FRAMEWORK={
"DEFAULT_AUTHENTICATION_CLASSES":["app01.service.auth.Authentication",]
}
认证顺序
认证类使用顺序：先用视图类中的验证类，再用settings里配置的验证类，最后用默认的验证类
局部使用例子
- models 层
class User(models.Model):
username=models.CharField(max_length=32)
password=models.CharField(max_length=32)
user_type=models.IntegerField(choices=((1,'超级用户'),(2,'普通用户'),(3,'二笔用户')))
class UserToken(models.Model):
user=models.OneToOneField(to='User')
token=models.CharField(max_length=64)
- 新建认证类(验证通过return两个参数)
from rest_framework.authentication import BaseAuthentication
class TokenAuth():
def authenticate(self, request):
token = request.GET.get('token')
token_obj = models.UserToken.objects.filter(token=token).first()
if token_obj:
return
else:
raise AuthenticationFailed('认证失败')
def authenticate_header(self,request):
pass
- view层 登录创建token,并存入数据库,下次登录认证token.
(1) 登录.....
def get_token(username):
import hashlib
import time
md = hashlib.md5()
# update内必须传bytes格式
md.update(username.encode('utf-8'))
md.update(str(time.time()).encode('utf-8'))
return md.hexdigest()
#认证
class Login(APIView):
authentication_classes = [ ]
def post(self, request):
response = MyResponse()
name = request.data.get('name')
pwd = request.data.get('pwd')
user = models.User.objects.filter(username=name, password=pwd).first()
if user:
response.msg = '登陆成功'
# 登陆成功，返回一个随机字符串，以后在发请求，都携带这个字符串
token = get_token(name)
response.token = token
# 把随机字符串保存到数据库,有就更新，没有就创建
# ret=models.UserToken.objects.update_or_create(user_id=user.id,kwargs={'token':token})
ret = models.UserToken.objects.update_or_create(user=user, defaults={'token': token})
else:
response.msg = '用户名或密码错误'
response.status = 101
return JsonResponse(response.get_dic,safe=False)
(2) 登录后 携带token 认证查询数据....
from app01.myauth import myAuthen
class Stus(APIView):
authentication_classes = [myAuthen,]
def get(self,request):
response = MyResponse()
#认证成功之后,可以去到用户名称,及token
print(request.user.username)
print(request.auth.token)
stus = models.Student.objects.all()
ret = myserial.StrSer(instance=stus,many=True)
response.msg = '查询成功'
response.data = ret.data
return JsonResponse(response.get_dic,safe=False)
- auth.py
from rest_framework.authentication import BaseAuthentication
#抛出异常,捕捉
from rest_framework.exceptions import AuthenticationFailed
from app01 import models
class myAuthen(BaseAuthentication):
def authenticate(self, request):
token = request.query_params.get('token')
ret = models.UserToken.objects.filter(token=token).first()
if ret:
# return ret.user, ret
# 要写多个认证类，这个地返回None
# 最后一个认证类，返回这俩值
return ret.user, ret
else:
raise AuthenticationFailed('您没有登陆')
附：不存数据库的token验证 就是通过某种的加密校验规则来验证
def get_token(id,salt='123'):
import hashlib
md=hashlib.md5()
md.update(bytes(str(id),encoding='utf-8'))
md.update(bytes(salt,encoding='utf-8'))
return md.hexdigest()+'|'+str(id)
def check_token(token,salt='123'):
ll=token.split('|')
import hashlib
md=hashlib.md5()
md.update(bytes(ll[-1],encoding='utf-8'))
md.update(bytes(salt,encoding='utf-8'))
if ll[0]==md.hexdigest():
return True
else:
return False
class TokenAuth():
def authenticate(self, request):
token = request.GET.get('token')
success=check_token(token)
if success:
return
else:
raise AuthenticationFailed('认证失败')
def authenticate_header(self,request):
pass
class Login(APIView):
def post(self,reuquest):
back_msg={'status':1001,'msg':None}
try:
name=reuquest.data.get('name')
pwd=reuquest.data.get('pwd')
user=models.User.objects.filter(username=name,password=pwd).first()
if user:
token=get_token(user.pk)
# models.UserToken.objects.update_or_create(user=user,defaults={'token':token})
back_msg['status']='1000'
back_msg['msg']='登录成功'
back_msg['token']=token
else:
back_msg['msg'] = '用户名或密码错误'
except Exception as e:
back_msg['msg']=str(e)
return Response(back_msg)
from rest_framework.authentication import BaseAuthentication
class TokenAuth():
def authenticate(self, request):
token = request.GET.get('token')
token_obj = models.UserToken.objects.filter(token=token).first()
if token_obj:
return
else:
raise AuthenticationFailed('认证失败')
def authenticate_header(self,request):
pass
class Course(APIView):
authentication_classes = [TokenAuth, ]
def get(self, request):
return HttpResponse('get')
def post(self, request):
return HttpResponse('post')
全局使用 在setting中添加
REST_FRAMEWORK={
"DEFAULT_AUTHENTICATION_CLASSES":["app01.service.auth.Authentication",]
}
源码分析
#Request对象的user方法
@property
def user(self):
the authentication classes provided to the request.
if not hasattr(self, '_user'):
with wrap_attributeerrors():
self._authenticate()
return self._user
def _authenticate(self):
for authenticator in self.authenticators:
try:
user_auth_tuple = authenticator.authenticate(self)
except exceptions.APIException:
self._not_authenticated()
raise
#认证成功，可以返回一个元组，但必须是最后一个验证类才能返回
if user_auth_tuple is not None:
self._authenticator = authenticator
self.user, self.auth = user_auth_tuple
return
self._not_authenticated()
self.authenticators
def get_authenticators(self):
return [auth() for auth in self.authentication_classes]