zoukankan      html  css  js  c++  java
  • Django rest framework 的认证流程(源码分析)

    一、基本流程举例:

    urlpatterns = [
        url(r'^admin/', admin.site.urls),
        url(r'^users/', views.HostView.as_view()),
       
    ]
    urls
    from rest_framework.views import APIView
    from rest_framework.response import Response
    class HostView(APIView):
        def dispatch(self, request, *args, **kwargs):
            """
            请求到来之后,都要执行dispatch方法,dispatch方法根据请求方式不同触发 get/post/put等方法
    
            注意:APIView中的dispatch方法有好多好多的功能
            """
            return super().dispatch(request, *args, **kwargs)
    
        def get(self, request, *args, **kwargs):
            return Response('GET请求,响应内容')
    
        def post(self, request, *args, **kwargs):
            return Response('POST请求,响应内容')
    
        def put(self, request, *args, **kwargs):
            return Response('PUT请求,响应内容')
    
    Views
    Views

    二、源码分析:

    当我们发送请求后,执行views里面对应的方法时,最开始执行的是dispatch方法

    ---------------------------------------------------------------------------------- 插叙-------------------------------------------------------------------------------------------

    为什么是diapach方法?

    我们使用rest framework 框架是基于CBV做的,在url中

        url(r'^hosts/', views.HostView.as_view()),
        url(r'^auth/', views.AuthView.as_view()),
        url(r'^users/', views.Userview.as_view()),
        url(r'^sals/', views.Salview.as_view()),

    进入as_view()

    APIView类中的as_view(),注意加红代码

    @classmethod
        def as_view(cls, **initkwargs):
            """
            Store the original class on the view function.
    
            This allows us to discover information about the view when we do URL
            reverse lookups.  Used for breadcrumb generation.
            """
            if isinstance(getattr(cls, 'queryset', None), models.query.QuerySet):
                def force_evaluation():
                    raise RuntimeError(
                        'Do not evaluate the `.queryset` attribute directly, '
                        'as the result will be cached and reused between requests. '
                        'Use `.all()` or call `.get_queryset()` instead.'
                    )
                cls.queryset._fetch_all = force_evaluation
    
            view = super(APIView, cls).as_view(**initkwargs)
            view.cls = cls
            view.initkwargs = initkwargs
    
            # Note: session based authentication is explicitly CSRF validated,
            # all other authentication is CSRF exempt.
            return csrf_exempt(view)

    进入原生View类中

    @classonlymethod
        def as_view(cls, **initkwargs):
            """
            Main entry point for a request-response process.
            """
            for key in initkwargs:
                if key in cls.http_method_names:
                    raise TypeError("You tried to pass in the %s method name as a "
                                    "keyword argument to %s(). Don't do that."
                                    % (key, cls.__name__))
                if not hasattr(cls, key):
                    raise TypeError("%s() received an invalid keyword %r. as_view "
                                    "only accepts arguments that are already "
                                    "attributes of the class." % (cls.__name__, key))
    
            def view(request, *args, **kwargs):
                self = cls(**initkwargs)
                if hasattr(self, 'get') and not hasattr(self, 'head'):
                    self.head = self.get
                self.request = request
                self.args = args
                self.kwargs = kwargs
                return self.dispatch(request, *args, **kwargs)
            view.view_class = cls
            view.view_initkwargs = initkwargs
    
            # take name and docstring from class
            update_wrapper(view, cls, updated=())
    
            # and possible attributes set by decorators
            # like csrf_exempt from dispatch
            update_wrapper(view, cls.dispatch, assigned=())
            return view

    可以看到最后返回的是

    return self.dispatch(request, *args, **kwargs)

    所以访问views中的类是先执行dispatch方法,然后再用调用 其他方法

    ---------------------------------------------------------------------------------- 插叙结束---------------------------------------------------------------------------------------

    自己定义的dispatch方法(当然自己可以不定义直接应用APIView里面的就可以了,默认就是这种):

    def dispatch(self, request, *args, **kwargs):
            """
            请求到来之后,都要执行dispatch方法,dispatch方法根据请求方式不同触发 get/post/put等方法
    
            注意:APIView中的dispatch方法有好多好多的功能
            """
            return super().dispatch(request, *args, **kwargs)

    APIView中的dispatch方法(源码):

    def dispatch(self, request, *args, **kwargs):
            """
            `.dispatch()` is pretty much the same as Django's regular dispatch,
            but with extra hooks for startup, finalize, and exception handling.
            """
            self.args = args
            self.kwargs = kwargs
            #1.将原来的request进行加工,增加了一些功能,将其放入restframework的Request
            '''
                request,
                parsers=self.get_parsers(),
                authenticators=self.get_authenticators(),
                negotiator=self.get_content_negotiator(),
                parser_context=parser_context
            '''
    
              # 原来request对象,django.core.handlers.wsgi.WSGIRequest
              # 现在的request对象,rest_framework.request.Request
            request = self.initialize_request(request, *args, **kwargs)
            self.request = request
            self.headers = self.default_response_headers  # deprecate?
    
            try:
                #2.处理版本信息 处理认证信息 处理权限信息 对用户的访问频率进行限制
                self.initial(request, *args, **kwargs)
    
                # Get the appropriate handler method
                #3.据用户提交的请求方法利用反射获取请求方法
                #http_method_names=['get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'trace']
                if request.method.lower() in self.http_method_names:
                    handler = getattr(self, request.method.lower(),
                                      self.http_method_not_allowed)
                else:
                    handler = self.http_method_not_allowed
                #调用具体的方法做具体的操作,
                response = handler(request, *args, **kwargs)
    
            except Exception as exc:
                response = self.handle_exception(exc)
    
            #4.将处理后的response包装
            self.response = self.finalize_response(request, response, *args, **kwargs)
            return self.response

    1.将原来的request进行加工,增加了一些功能,将其放入restframework的Request

    request = self.initialize_request(request, *args, **kwargs)

    进入initialize_request函数后:

    def initialize_request(self, request, *args, **kwargs):
            """
            Returns the initial request object.
            """
            parser_context = self.get_parser_context(request)
    
            return Request(
                request,
                parsers=self.get_parsers(),
                authenticators=self.get_authenticators(),#用于用户认证,为一个列表
                negotiator=self.get_content_negotiator(),
                parser_context=parser_context
            )

    将这些东西前部都封装在rest_framework的Resquest中,并返回她的对象request,从这以后我们调用的request对象不再是Django提供的request对象了,而是APIView的Resquest的对象,2.处理版本信息 处理认证信息 处理权限信息 对用户的访问频率进行限制

    self.initial(request, *args, **kwargs)

    def initial(self, request, *args, **kwargs):
            """
            Runs anything that needs to occur prior to calling the method handler.
            """
            self.format_kwarg = self.get_format_suffix(**kwargs)
    
            # Perform content negotiation and store the accepted info on the request
            neg = self.perform_content_negotiation(request)
            request.accepted_renderer, request.accepted_media_type = neg
    
            # Determine the API version, if versioning is in use.
            #2.1处理版本信息
            version, scheme = self.determine_version(request, *args, **kwargs)
            request.version, request.versioning_scheme = version, scheme
    
            # Ensure that the incoming request is permitted
            #2.2处理认证信息
            self.perform_authentication(request)
            #2.3处理权限信息
            self.check_permissions(request)
            #2.4对用户的访问频率进行限制
            self.check_throttles(request)

    3.据用户提交的请求方法利用反射获取请求方法,并改用请求方法实现其具体功能

    4.将处理后的response进行包装

    三、处理认证的具体分析

    当diapatch方法进行到第一步时,我们调用了initialize_request方法将request等封装在Request中顶返回其对象

    def initialize_request(self, request, *args, **kwargs):
            """
            Returns the initial request object.
            """
            parser_context = self.get_parser_context(request)
    
            return Request(
                request,
                parsers=self.get_parsers(),
                authenticators=self.get_authenticators(),#用于用户认证,为一个列表
                negotiator=self.get_content_negotiator(),
                parser_context=parser_context
            )

    authenticators=self.get_authenticators() #用于用户认证 是一个由authentication对象组成的列表

    def get_authenticators(self):
            """
            Instantiates and returns the list of authenticators that this view can use.
            """
            return [auth() for auth in self.authentication_classes]
    authentication_classes为一个authentication类组成的列表,他默认是调用
    authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES

    当然我们一般是自己定义或者配置到settings中,至此我们的得到authentication对象的列表,其封装在Request对象中,

    接的执行第二步

    #2.处理版本信息 处理认证信息 处理权限信息 对用户的访问频率进行限制
    self.initial(request, *args, **kwargs)
    #2.2处理认证信息
            self.perform_authentication(request)

    查看perform_authentication的源码如下

    def perform_authentication(self, request):
            """
            Perform authentication on the incoming request.
    
            Note that if you override this and simply 'pass', then authentication
            will instead be performed lazily, the first time either
            `request.user` or `request.auth` is accessed.
            """
            request.user

    其调用了rest_framework中Request的user方法(这个方法肯定别@property装饰,不然的话不可能直接不加括号的调用)

    from rest_framework.request import Request

    Request类中的user方法

    @property
        def user(self):
            """
            Returns the user associated with the current request, as authenticated
            by the authentication classes provided to the request.
            """
            #判断当前类中是否有已经认证过的user
            if not hasattr(self, '_user'):
                #没有认证则去认证
                self._authenticate()
            #认证过了直接返回
            return self._user

    注意:user中的self代表的是request对象

    没认证的话执行 调用Request类中的_authenticate()方法

    def _authenticate(self):
            """
            Attempt to authenticate the request using each authentication instance
            in turn.
            """
            #遍历request对象中封装的Authentication对象
            for authenticator in self.authenticators:
                try:
                    #调用Authentication对象中的authenticate方法,必须要有这个方法不然抛出异常
                    #当然Authentication类一般有我们自己定义,实现这个方法就可以了
                    user_auth_tuple = authenticator.authenticate(self)
                except exceptions.APIException:
                    self._not_authenticated()
                    raise
    
                if user_auth_tuple is not None:
                    self._authenticator = authenticator
                    self.user, self.auth = user_auth_tuple
                    return
    
            self._not_authenticated()

    认证实例:

    局部认证:直接类中定义Authentication类

    ---models.py

    from
    django.db import models # Create your models here. class Userinfo(models.Model): name=models.CharField(max_length=32,verbose_name='用户名') pwd=models.CharField(max_length=32,verbose_name='密码') token=models.CharField(max_length=64,null=True) def __str__(self): return self.name
    ----urls.py
    
    urlpatterns = [
        url(r'^admin/', admin.site.urls),
        url(r'^users/', views.HostView.as_view()),
        url(r'^auth/', views.AuthView.as_view()),
    ]
    ---views.py

    import
    json import hashlib import time from django.shortcuts import render, HttpResponse from rest_framework.views import APIView from rest_framework.authentication import SessionAuthentication from rest_framework.authentication import BaseAuthentication from rest_framework.request import Request from rest_framework.exceptions import APIException from rest_framework.response import Response from app01 import models # Create your views here. class MyAuthentication(object): def authenticate(self, request): token = request.query_params.get('token') user=models.Userinfo.objects.filter(token=token).first() if user: return (user.name, 'aaaaaa') raise APIException('认证失败') class AuthView(APIView): # 设置为空标识不用认证 authentication_classes = [] # setting中没有设置,单独设置,就局部验证 def get(self, request, *args, **kwargs): dic = {'code': 1000, 'msg': ''} pwd = request.query_params.get('pwd') name = request.query_params.get('name') user = models.Userinfo.objects.filter(name=name, pwd=pwd).first() if not user: dic['msg'] = '用户名或密码错误' dic['code'] = 1001 return Response(dic) t = time.time() key = '%s|%s' % (name, t) m = hashlib.md5() m.update(key.encode('utf-8')) token = m.hexdigest() user.token = token user.save() dic['token'] = token dic['msg'] = '登陆成功' return Response(dic) class HostView(APIView): authentication_classes=[MyAuthentication,] def dispatch(self, request, *args, **kwargs): """ 请求到来之后,都要执行dispatch方法,dispatch方法根据请求方式不同触发 get/post/put等方法 注意:APIView中的dispatch方法有好多好多的功能 """ return super().dispatch(request, *args, **kwargs) def get(self, request, *args, **kwargs): return Response('GET请求,响应内容') def post(self, request, *args, **kwargs): return Response('POST请求,响应内容') def put(self, request, *args, **kwargs): return Response('PUT请求,响应内容')

    全局认证;在settings中配置

    from django.db import models
    
    # Create your models here.
    class Userinfo(models.Model):
        name=models.CharField(max_length=32,verbose_name='用户名')
        pwd=models.CharField(max_length=32,verbose_name='密码')
        token=models.CharField(max_length=64,null=True)
    
        def __str__(self):
            return self.name
    models
    urlpatterns = [
        url(r'^admin/', admin.site.urls),
        url(r'^users/', views.HostView.as_view()),
        url(r'^auth/', views.AuthView.as_view()),
    ]
    urls
    from rest_framework.exceptions import APIException
    from rest_framework.response import Response
    from rest_framework.authentication import BaseAuthentication
    
    from app01 import models
    
    
    
    class MyAuthentication(BaseAuthentication):
        def authenticate(self, request):
            token = request.query_params.get('token')
            user=models.Userinfo.objects.filter(token=token).first()
            if user:
                return (user.name, 'aaaaaa')
            raise APIException('认证失败')
    utils:自定义验证类
    REST_FRAMEWORK = {
        'UNAUTHENTICATED_USER': None,
        'UNAUTHENTICATED_TOKEN': None,
        "DEFAULT_AUTHENTICATION_CLASSES": [
            "app01.utils.MyAuthentication",
        ],
    }
    
    settings中
    settings
    
    
  • 相关阅读:
    TOI2008 二元一次联立方程式
    福州三中信息学奥赛培训网址
    Youtube视频下载方式
    abs和其他绝对值的区别
    【转】C语言浮点数运算
    [转]解析字符串的方法
    TOI2008 大数运算
    【ZeroJudge】d781 Anagram
    【转载】NDatabase 5 Minutes Tutorial
    左岸读书编程是最能表达人类的思维的语言
  • 原文地址:https://www.cnblogs.com/sunxiuwen/p/9963782.html
Copyright © 2011-2022 走看看