16 django用户认证组件

django用户认证组件

思考：

　　前一篇提到的seesion，当用户登录后会保存session。

　　浏览器再次访问会带上服务器返回的session：sessionid ---> 登录时随机生成的key

　　服务器拿到sessionid后去数据库匹配，匹配到后拿到一个字典数据：{a:b,c:d}

　　当数据有变化时，会更新某个值，如 c:d --> c:e ，那么直接更新数据库 {a:b,c:e}，sessionid并不会变化，然后将原来的sessionid继续回传给浏览器。

　　这样的处理机制存在什么样的问题呢？

问题：

　　A在浏览器登录，登录信息是A用户的，比如服务器的一些权限控制，角色控制信息，这个时候保存在seesion库里，当B又用浏览器登录，因为用一个浏览器，传给服务器的sessionid是一样的，那么在更新B的数据的时候，可能部分A的信息，并不会删掉，服务器会在A的基础上做更新，那么就存在数据错乱的风险，B获得A的敏感信息。

解决：

　　判断是不是同一个用户，不同用户，同一个sessionid，先清空A的信息，再写入B的信息。

　　我们当然可以自己做一套，但是django已经帮我们实现了，我们直接用就好，这就是用户认证组件。

先settings配置好数据库，然后运行以下命令进行数据库初始化，因为要用到其中的session表。

"""
Django settings for auther project.

Generated by 'django-admin startproject' using Django 2.2.3.

For more information on this file, see
https://docs.djangoproject.com/en/2.2/topics/settings/

For the full list of settings and their values, see
https://docs.djangoproject.com/en/2.2/ref/settings/
"""

import os

# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))


# Quick-start development settings - unsuitable for production
# See https://docs.djangoproject.com/en/2.2/howto/deployment/checklist/

# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = '6y-h4%y^%+2^@_2y7xyz0fc98faozkvh(xp!)h4)q8n0hsx+ee'

# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = True

ALLOWED_HOSTS = []


# Application definition

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'auth_app01',
]

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

ROOT_URLCONF = 'auther.urls'

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [os.path.join(BASE_DIR, 'templates')],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',
            ],
        },
    },
]

WSGI_APPLICATION = 'auther.wsgi.application'


# Database
# https://docs.djangoproject.com/en/2.2/ref/settings/#databases

# DATABASES = {
#     'default': {
#         'ENGINE': 'django.db.backends.sqlite3',
#         'NAME': os.path.join(BASE_DIR, 'db.sqlite3'),
#     }
# }


# Password validation
# https://docs.djangoproject.com/en/2.2/ref/settings/#auth-password-validators

AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
    },
]


# Internationalization
# https://docs.djangoproject.com/en/2.2/topics/i18n/

LANGUAGE_CODE = 'en-us'

TIME_ZONE = 'UTC'

USE_I18N = True

USE_L10N = True

USE_TZ = True


# Static files (CSS, JavaScript, Images)
# https://docs.djangoproject.com/en/2.2/howto/static-files/

STATIC_URL = '/static/'
STATICFILES_DIRS = [
    os.path.join(BASE_DIR, 'statics')
]

LOGIN_URL = '/app01/login'

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.mysql',
        'NAME':'auth',# 要连接的数据库，连接前需要创建好
        'USER':'root',# 连接数据库的用户名
        'PASSWORD':'',# 连接数据库的密码
        'HOST':'127.0.0.1',# 连接主机，默认本级
        'PORT':3308 #  端口 默认3306
    }
}

LOGGING = {
    'version': 1,
    'disable_existing_loggers': False,
    'handlers': {
        'console':{
            'level':'DEBUG',
            'class':'logging.StreamHandler',
        },
    },
    'loggers': {
        'django.db.backends': {
            'handlers': ['console'],
            'propagate': True,
            'level':'DEBUG',
        },
    }
}

python manage.py makemigrations

python manage.py migrate

视图函数

from django.shortcuts import render, redirect, HttpResponse
from auth_app01.myforms import Form, LoginForm
from django.contrib import auth
from django.contrib.auth.models import User
from django.contrib.auth import authenticate, login, logout
from django.contrib.auth.decorators import login_required
from auther import settings


def index(request):
    if not request.user.is_authenticated:
        print(request.user)
    else:
        print('no user')
    return render(request, 'index.html')


def regist(request):
    if request.method == 'POST':
        form = Form(request.POST)
        if form.is_valid():
            print(form.cleaned_data)
            username = form.cleaned_data['name']
            email = form.cleaned_data['email']
            pwd = form.cleaned_data['pwd']
            user = None

            # 注意创建用户的时候要用create_user方法  用create的话不会对密码进行加密
            res = User.objects.create_user(username=username,email=email,password=pwd)

            # 注册完成之后 调用 authenticate() 进行认证得到一个  User  对象
            if res:
                user = authenticate(username=username, password=pwd)

            # login函数接受一个HttpRequest对象，以及一个认证了的User对象
            # login函数使用django的session框架给某个已认证的用户附加上sessionid等信息
            # 链接跳转到index后 会带上sessionid信息，且 request.user 定义成了一个全局变量任何地方都可以用，包括模板
            if user:
                login(request, user)

            return redirect('/app01/index/')
        else:
            print(form.cleaned_data)
            print(form.errors)
        return render(request, 'regist.html', locals())
    else:
        form = Form()
        return render(request, 'regist.html', locals())


def mylogin(request):
    if request.method == 'POST':
        form = LoginForm(request.POST)
        if form.is_valid():
            print(form.cleaned_data)
            username = form.cleaned_data.get('name')
            pwd = form.cleaned_data.get('pwd')
            user = auth.authenticate(username=username,password=pwd)
            if user:
                login(request, user)
                # next_url 用户请求可能是其他请求重定向过来的，登录完成后，根据next值返回到相应的url
                next_url = request.GET.get('next', '/app01/index')
                return redirect(next_url)
            else:
                error = '用户名或密码错误！'
                return render(request, 'login.html', locals())
    else:
        form = LoginForm()
        return render(request, 'login.html', locals())


def mylogout(request):
    # 接受一个HttpRequest对象，无返回值。调用时，当前请求的session信息会全部清除。该用户即使没有登录，使用该函数也不会报错。
    logout(request)
    return redirect( '/app01/index/')


# 上面通过auth已经实现了简单的登录注册以及首页之间的跳转 但是实际场景存在这样的情况：
# 1  用户登陆后才能访问某些页面，
# 2  如果用户没有登录就访问该页面的话直接跳到登录页面
# 3  用户在跳转的登陆界面中完成登陆后，自动访问跳转到之前访问的地址

# 方式一
def secret(request):
    if request.user.is_authenticated:
        my_secret = 'secret'
        return render(request, 'secret.html',locals())
    else:
        return redirect("%s?next=%s" % (settings.LOGIN_URL, request.path))

# 方式二  login_required 装饰器
#若用户没有登录，则会跳转到django默认的 登录URL '/accounts/login/ ' (这个值可以在settings文件中通过LOGIN_URL进行修改)。
# 并传递  当前访问url的绝对路径 (登陆成功后，会重定向到该路径)。
@login_required
def mimi(request):
    my_secret = 'mimi'
    return render(request, 'secret.html',locals())


# 修改密码
@login_required
def set_password(request):
    user = request.user
    state = None
    if request.method == 'POST':
        old_password = request.POST.get('old_password', '')
        new_password = request.POST.get('new_password', '')
        repeat_password = request.POST.get('repeat_password', '')
        if user.check_password(old_password):
            if not new_password:
                state = 'empty'
            elif new_password != repeat_password:
                state = 'repeat_error'
            else:
                user.set_password(new_password)
                user.save()
                return redirect("/app01/login/")
        else:
            state = 'password_error'
    content = {
        'user': user,
        'state': state,
    }
    return render(request, 'password.html', content)

forms组件

from django import forms
from django.forms import widgets
from django.core.exceptions import ValidationError
from django.contrib.auth.models import User


name_widget = widgets.TextInput(attrs={'class':'form-control'})
pwd_widget = widgets.PasswordInput(attrs={'class':'form-control'})


class Form(forms.Form):
    name = forms.CharField(min_length=4, max_length=16, widget=name_widget, label='用户名')
    pwd = forms.CharField(min_length=4, max_length=16, widget=pwd_widget, label='密码')
    email = forms.EmailField(widget=name_widget, label='邮箱')

    def clean_name(self):
        val = self.cleaned_data.get('name')
        res = User.objects.filter(username=val).exists()
        if not res:
            return val
        else:
            raise ValidationError('用户名已存在！')


class LoginForm(forms.Form):
    name = forms.CharField(min_length=4, max_length=16, widget=name_widget, label='用户名')
    pwd = forms.CharField(min_length=4, max_length=16, widget=pwd_widget, label='密码')

url分发器

from django.urls import path, re_path
from auth_app01 import views


urlpatterns = [
    path('index/', views.index),
    path('regist/', views.regist),
    path('login/', views.mylogin),
    path('logout/', views.mylogout),
    path('secret/', views.secret),
    path('mimi/', views.mimi),
]

index.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>index</title>
    <link rel="stylesheet" href="/static/bootstrap.min.css">
</head>
<body>
<div class="container">
    <div class="row">
        <div class="col-md-6 col-md-offset-3">
            <h3>欢迎进入首页</h3>
            {% if not request.user.is_authenticated %}
                <a href="/app01/login" class="btn btn-success">登录</a>
                <a href="/app01/regist" class="btn btn-success">注册</a>
            {% else %}
                <h4>hi,{{ request.user }}</h4>
                <a href="/app01/logout" class="btn btn-success">注销</a>
            {% endif %}
        </div>
    </div>
</div>
</body>
</html>

login.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>login</title>
    <link rel="stylesheet" href="/static/bootstrap.min.css">
</head>
<body>

<div class="container">
    <div class="row">
        <div class="col-md-6 col-md-offset-3">
            <h4>登录</h4>
            <form action="" method="post">
                {% csrf_token %}
                {% for field in form %}
                    <div class="form-group">
                        <label for="">{{ field.label }}</label>
                        {{ field }}
                        <span class="pull-right" style="color: red">{{ field.errors.0 }}</span>
                    </div>
                {% endfor %}
                <input type="submit" class="btn btn-success">
                <span class="pull-right" style="color: red">{{ error }}</span>
            </form>
        </div>
    </div>
</div>

</body>
</html>

regist.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>regist</title>
    <link rel="stylesheet" href="/static/bootstrap.min.css">
</head>
<body>

<div class="container">
    <div class="row">
        <div class="col-md-6 col-md-offset-3">
            <h4>注册</h4>
            <form action="" method="post">
                {% csrf_token %}
                {% for field in form %}
                    <div class="form-group">
                        <label for="">{{ field.label }}</label>
                        {{ field }}
                        <span class="pull-right" style="color: red">{{ field.errors.0 }}</span>
                    </div>
                {% endfor %}
                <input type="submit" class="btn btn-success">
            </form>
        </div>
    </div>
</div>

</body>
</html>

secret.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>secret</title>
</head>
<body>

{{ my_secret }}
<h3>你很帅！</h3>

</body>
</html>