【Django】rest_framework框架认证流程

迷南。 2023-02-23 09:28 4阅读 0赞

## rest\_framework框架认证流程 ##

**参考[Django rest framework源码分析（1）----认证][Django rest framework_1_----]**

> 基于CBV使用rest\_framework框架，基于反射实现根据请求方式不同，执行不同的方法。原理：url–>view方法–>dispatch方法（反射执行其他方法：GET/POST/PUT/DELETE等）。

# 1、在settings的app中添加rest_framework
    INSTALLED_APPS = {
        
        'rest_framework',
    }
    
    # 配置url
    from django.contrib import admin
    from django.urls import path
    fromm API.views import AuthView
    
    urlpatterns = [
        path('admin/', admin.site.urls),
        path('api/v1/auth/', AuthView.as_view()),
    ]
    
    # models，一个保存用户的信息，一个保存用户登录成功后的token
    from django.db import models
    
    class UserInfo(models.Model):
        USER_TYPE= (
            (1, '普通用户'),
            (2, 'VIP'),
            (3, 'SVIP')
        )
    
        user_type = models.IntegerField(choices=USER_TYPE)
        username = models.CharField(max_length=32)
        password = models.CharField(max_length=64)
    
    class UserToken(models.Model):
        user = models.OneToOneField(UserInfo, on_delete=models.CASCADE)
        token = models.CharField(max_length=64)
    
    # 用户登录的views
    from django.shortcuts import render
    from django.http import JsonResponse
    from rest_framework.views import APIView  # rest_framework框架，继承View
    from API import models
    import hashlib
    import time
    
    
    def md5(user):
        # 当前时间，相当于生成一个随机的字符串
        ctime = str(time.time())
        m = hashlib.md5(bytes(user, encoding="utf-8"))
        m.update(bytes(ctime, encoding="utf-8"))
        return m.hexdigest()
    
    class AuthView(object):
        # 用于用户登录验证
        def post(self, request, *args, **kwargs):
            ret = ('code': 1000, 'msg': None)
            try:
                user = request._request.POST.get('username')
                pwd = request._request.POST.get('password')
                obj = models.UserInfo.objects.filter(username=user, password=pwd).first()
                if not obj:
                    ret['code'] = 1001
                    ret['msg'] = '用户名或密码错误'
                # 为用户创建token
                token = md5(user)
                # 存在就更新，不存在就创建
                models.UserToken.objects.update_or_create(user=obj, default={
        'token': token})
                ret['token'] = token
    
            except Exception as e:
                ret['code'] = 1002
                ret['msg'] = '请求异常'
            return JsonResponse(ret)
    
    # 添加一个认证类
    from rest_framework.request import Request
    from rest_framework import exceptions # 验证失败触发异常
    from rest_framework.authentication import BasicAuthentication
    
    ORDER_DICT = {
        
        1:{
        
            'name': 'apple',
            'price': 15
        },
        2:{
        
            'name': 'dog',
            'price': 100
        }
    }
    
    class Authentication(APIView):
        # 认证
        def authenticate(self, request):
            token = request._request.GET.get('token')
            token_obj = models.UserToken.objects.filter(token=token).first()
            if not token_obj:
                raise exceptions.AuthenticationFailed('用户认证失败')
            # 在rest_framework内部将会这两个字段赋值给request，以供后续操作使用
            return (token_obj.user, token_obj)
    
        def suthenticate_header(self, request):
            pass
    
    class OrderView(APIView):
        # 订单相关业务
        authentication_classes = [Authentication,]  # 添加认证
        def get(self, request, *args, **kwargs):
            ret = {
        'code': 1000, 'msg': None, 'data': None}
            try:
                ret['data'] = ORDER_DICT
            except Exception as e:
                pass
            return JsonRespone(ret)
    
        def post(self, request, *args, **kwargs):
            return HttpResponse("post")
    
        def put(self, request, *args, **kwargs):
            return HttpResponse("put")
    
        def delete(self, request, *args, **kwargs):
            return HttpResponse("delete")

> drf的认证可研究下源码，BaseAuthentication源码。

> 自己写认证类方法：

*  创建认证类：继承BaseAuthentication类，重写authenticate方法，authenticate\_header方法直接写pass即可。
 *  authenticate()返回值：None表示当前认证不管等下一个认证执行；`raise exceptions.AuthenticationFailed('用户认证失败')`；返回值是元组形式。
 *  局部使用：`authentication_classes=[BaseAuthentication,]`
 *  全局使用：`REST_FRAMEWORK = {"DEFAULT_AUTHENTICATION_CLASSES": ['API.utils.auth.Authentication',]}`

[Django rest framework_1_----]: https://www.cnblogs.com/derek1184405959/p/8712206.html