Django:RestFramework之-------认证

3 restframework-认证

3.1APIView 认证：

• 认证是否已经登陆，如果已经登陆返回元组，如果没有登陆报错
• 源码流程：

执行dispatch方法：


def dispatch(self, request, *args, **kwargs):
    #1.封装request    对原生request进行加工，执行initialize_request方法
   	request = self.initialize_request(request, *args, **kwargs)
    try:
        #2.认证
        self.initial(request, *args, **kwargs)
        
#--------------------initialize_request-------------------
#执行initialize_request:
def initialize_request(self, request, *args, **kwargs):
   """
   Returns the initial request object.
   """
   parser_context = self.get_parser_context(request)
	#返回实例化Request,把原有的request进行封装，丰富功能
    return Request(
    request,
    parsers=self.get_parsers(),
    authenticators=self.get_authenticators(),
    negotiator=self.get_content_negotiator(),
    parser_context=parser_context
    )
#---------------------------------------------------------

#--------------------Request------------------------------
#而Request类中：实例化方法中定义：
class Request:
    def __init__(self, request, parsers=None, authenticators=None,
                 negotiator=None, parser_context=None):
        assert isinstance(request, HttpRequest), (
            'The `request` argument must be an instance of '
            '`django.http.HttpRequest`, not `{}.{}`.'
            .format(request.__class__.__module__, request.__class__.__name__)
        )

        self._request = request#1
        self.parsers = parsers or ()
        self.authenticators = authenticators or ()#
        self.negotiator = negotiator or self._default_negotiator()
        self.parser_context = parser_context
        self._data = Empty
        self._files = Empty
        self._full_data = Empty
        self._content_type = Empty
        self._stream = Empty
#1 ： 获取原生request  通过  request._request
#2 :  获取认证类的对象    通过 request.authenticators
#返回dispatch方法中继续走
#---------------------------------------------------------

#--------------------initial----------------------------
#再initial执行方法：
	def initial(self, request, *args, **kwargs):
        ...
        #4.实现认证
        self.perform_authentication(request)
#---------------------------------------------------------
#--------------------perform_authentication---------------
#返回当前登陆用户，此时request为封装加工后的request
    def perform_authentication(self, request):
        request.user
#---------------------------------------------------------
#---------------------------Request----------------------
#执行request为Request类中实例化的对象，通过.user执行user方法
class Request:
    ...
    @property
    def user(self):
       
        if not hasattr(self, '_user'):
            with wrap_attributeerrors():
                #获取认证对象，进行一步步认证
                self._authenticate()
        return self._user
#---------------------------------------------------------
#----------------_authenticate-------------------------
    def _authenticate(self):
        #authentication_classes=[BasicAuthentication对象，]
       #authenticators为定义authentication_classes=中的对象
    	#循环所有认证对象。
        for authenticator in self.authenticators:
            try:
                #通过authenticate方法验证是否登陆，如果登陆返回元组，如果未登陆报错
                user_auth_tuple = authenticator.authenticate(self)
            except exceptions.APIException:
                self._not_authenticated()
                raise

            if user_auth_tuple is not None:
                self._authenticator = authenticator
                self.user, self.auth = user_auth_tuple
                return
#---------------------------------------------------------
#-------------------------authenticate-----------------------------
    def authenticate(self, request):
        return (self.force_user, self.force_token)

• 那么如何自己定义认证：

import json

from django.http import HttpResponse
from django.shortcuts import render
from rest_framework.decorators import authentication_classes#用于自定义实现认证

from rest_framework.views import APIView
from rest_framework import exceptions#用于认证失败引发错误
class MyAuthentication(object):
    #重写authenticate方法
    def authenticate(self,request):
        token = request._request.GET.get('token')
        print(token)
        if not token:
            raise exceptions.AuthenticationFailed("用户认证失败")
        return ("hello",None)

    def authenticate_header(self,val):pass


class DogView(APIView):
    #自定义认证类
    authentication_classes = [MyAuthentication,]
    def get(self,request,*args,**kwargs):
        ret = {
            "code":1000,
            'msg':"OK"
        }
        return HttpResponse(json.dumps(ret),status=200)

    def post(self,request,*args,**kwargs):
        return HttpResponse("创建Dog")
#www.xxx.com/?token=123

• 效果：

  • 当访问URL为<http://127.0.0.1:8000/dog/

  

  • 当访问URL为<http://127.0.0.1:8000/dog/?token=123>

  

• 基于认证总结：

  源码流程 dispatch开始
  

3.2 用户登陆

• models.py

  class UserInfo(models.Model):
      user_type_choice = {
          (1,"普通用户"),
          (2,"VIP"),
          (3,"SVIP")
      }
  
      user_type = models.IntegerField(choices=user_type_choice)
      username = models.CharField(max_length=32,unique=True)
      password = models.CharField(max_length=32)
  
  
  class UserToken(models.Model):
      user = models.OneToOneField(to="UserInfo")
      token = models.CharField(max_length=32)
  

• views.py

def md5(user):
    """密码加密"""
    import hashlib
    import time
    ctime = str(time.time())
    m = hashlib.md5(bytes(user,encoding='utf-8'))
    m.update(bytes(ctime,encoding="utf-8"))
    return m.hexdigest()

class AuthView(APIView):
    def post(self,request,*args,**kwargs):
        ret = {"code":1000,"msg":None}
        try:
            username = request._request.POST.get('username')
            password = request._request.POST.get('password')
            obj = models.UserInfo.objects.filter(username=username,password=password).first()
            if not obj:
                ret["code"] = 1001
                ret["msg"] = "用户密码错误"
            #为登陆用户创建token
            token = md5(username)
            #存在更新，不存在创建，保存Token
            models.UserToken.objects.update_or_create(user=obj,defaults={"token":token})

        except Exception as e:
            ret["code"] = 1002
            ret["msg"] = "请求异常"

        return JsonResponse(ret)

3.3用户登陆实现token认证

#充当数据库数据
ORDER_DICT = {
    1: {
        'name': '媳妇',
        'age': 18,
        'gender': '男',
        'content': '...'
    },
    2: {
        'name': '老狗',
        'age': 19,
        'gender': '男',
        'content': '....'
    }
}


#自定义认证类
class Authtication(object):
    def authenticate(self,request):
        token = request._request.GET.get("token")
        token_obj = models.UserToken.objects.filter(token=token).first()
        #如果token表示用户认证失败
        if not token_obj:
            raise exceptions.AuthenticationFailed("用户认证失败")
        #在restframework内部会将这两个字段赋值给request,以供后续使用
        #第一个值通过request.user可以获取
        #第二个值通过reuqest.auth可以获取
        return (token_obj.user,token_obj)

    def authenticate_header(self, val): pass

class OrderView(APIView):
    authentication_classes = [Authtication,]
    def get(self,request,*args,**kwargs):
        # token = request._request.GET.get("token")
        # if not token:
        #     return HttpResponse("用户未登陆")
        ret = {"code": 1000, "msg": None, "data": None}
        try:
            ret['data'] = ORDER_DICT
        except Exception as e:
            pass
        return JsonResponse(ret)
#通过restframework让视图函数只做数据处理，认证交给authentication_classes，代码逻辑清晰不少。

3.4认证流程原理

• drf认证组件的实现过程:

  as_view() --->view --->执行dispatch方法，
  为自己dispatch方法。通过initialize_request将request对象进行了重新封装。通过initial执行perform_authentication，Request执行user方法去执行_authenticate,遍历循环authentication_classes所有对象。执行认证类的方法.
  	有三种情况：
  		1.如果有返回值，是一个元组 request.user,request.auth
  		2.如果返回None,下一个认证来处理:
  			当都返回None:request.user = AnonymousUser, request.auth = None
  		3.抛出异常，执行self.not_authenticated()
  			
  

• 当都返回None, request.user = AnonymousUser, request.auth = None.(设置默认值，表示未登陆)

• 源码中 全局使用配置项：

  将自己定义认证类配置在rest_framework配置项目中
  #当前项目新建文件夹，新建py文件，放入认证类
  settings.py配置
  REST_FRAMEWORK = {
      #全局使用认证类。
  	'DEFAULT_AUTHENTICATION_CLASSES':['api.utils.auth.Authtication',],
  	#设置匿名用户None。
      'UNAUTHENTICATED_USER':None,#request.user = None
      'UNAUTHENTICATED_TOKEN':None,#当前用户未登陆表示匿名用户 request.auth = None
  }
  
  #这样类视图都不用加authentication_classes，也可以执行认证。对于不需要认证的类视图，可以添加未 authentication_classes = []
  

3.5 django内置认证类

• 如下：5个类：

class BaseAuthentication:
    
class BasicAuthentication(BaseAuthentication):#通过浏览器生成登陆模态框，实现base64加密,把加密后信息放在请求头发过去。
  
class SessionAuthentication(BaseAuthentication):

class TokenAuthentication(BaseAuthentication):

class RemoteUserAuthentication(BaseAuthentication):
  

• 为了让我们写认证类，更加规范，自定义认证类都必须要继承于BaseAuthentication

class BaseAuthentication:
    """
    All authentication classes should extend BaseAuthentication.
    """

    def authenticate(self, request):
        """
        Authenticate the request and return a two-tuple of (user, token).
        """
        raise NotImplementedError(".authenticate() must be overridden.")

    def authenticate_header(self, request):
        #当认证失败时候，浏览器给返回响应头
        """
        Return a string to be used as the value of the `WWW-Authenticate`
        header in a `401 Unauthenticated` response, or `None` if the
        authentication scheme should return `403 Permission Denied` responses.
        """
        pass
#所有定义认证类必须有authenticate，authenticate_header方法。否则无法正常执行代码