django-rest-framework 基础三 认证、权限和频率
django-rest-framework 基础三 认证、权限和频率
1. 认证
登录接口: 登录成功只要给前端返回json格式字符串，这个字符串中带一个随机字符串(可以使用uuid生成)
登录接口步骤:
前端传入用户名和密码，然后去user表中查找，能找到说明用户和密码没问题，登录成功，然后在userToken表中存一条记录，说明登录过了，再返回前端一个json字符串
1.1 登录接口
models.py
from django.db import models
# Create your models here.
class User(models.Model):
username = models.CharField(max_length=64)
password = models.CharField(max_length=128)
user_type = models.IntegerField(choices=((1, "超级管理员"),(2,"管理员"),(3,"普通用户")))
class UserToken(models.Model):
user = models.OneToOneField(to=User,on_delete=models.CASCADE)
userToken = models.CharField(max_length=64)
views.py
from django.shortcuts import render
# Create your views here.
from rest_framework.viewsets import GenericViewSet
from authenticated.models import User,UserToken
from rest_framework.response import Response
from rest_framework.decorators import action
import uuid
class UserView(GenericViewSet):
@action(methods=['POST'], detail=False)
def login(self,request):
username = request.data.get("username")
password = request.data.get("password")
user = User.objects.filter(username=username, password=password).first()
if not user:
return Response({"code":1001,"msg":"用户名或密码错误"})
token = str(uuid.uuid4()) # 获取一个不重复的值，做唯一标识
# userToken表中有就更新，没有就创建
#UserToken.objects.update_or_create(user=user, defaults={'token': token})
UserToken.objects.update_or_create(user=user, defaults={'userToken': token})
# 返回信息，并带着token
return Response({"code":1000,"msg":"登录成功",'userToken': token})
urls.py
from django.contrib import admin
from django.urls import path,include
from authenticated import views
from rest_framework import routers
router = routers.SimpleRouter()
router.register('user',views.UserView, "user")
urlpatterns = [
path('admin/', admin.site.urls),
path('', include(router.urls))
]
访问:
post请求： http://127.0.0.1:8000/user/login/
1.2 认证
有了登录接口，就可以实现认证，如果要调用别的接口必须要先登录才可以。
例如有个图书的表有五个接口，要访问图书的五个接口必须就登录。
步骤：
1. 先写一个类，继承BaseAuthentication，并重写authenticate方法,在方法中校验是否登录，登录则返回两个值，没有则拋异常
from rest_framework.authentication import BaseAuthentication
class xxxx(BaseAuthentication):
def authenticate(self, request):
2. 全局配置和局部配置
全局配置:
settings.py中
REST_FRAMEWORK = {
"DEFAULT_AUTHENTICATION_CLASSES":["authenticated.authentication.LoingAuth"]
}
局部配置：
在视图类中：
authentication_classes = [xxxx,]
禁止局部署配置：
authentication_classes = []
登录则返回两个值:
request.user 当前登录的用户
request.auth 为当前登录用户的token
示例:
models.py
from django.db import models
# Create your models here.
class User(models.Model):
username = models.CharField(max_length=64)
password = models.CharField(max_length=128)
user_type = models.IntegerField(choices=((1, "超级管理员"),(2,"管理员"),(3,"普通用户")))
class UserToken(models.Model):
user = models.OneToOneField(to=User,on_delete=models.CASCADE)
userToken = models.CharField(max_length=64)
class Book(models.Model):
name = models.CharField(max_length=64)
price = models.DecimalField(max_digits=5, decimal_places=2)
author = models.CharField(max_length=64)
认证功能,在app中新建authentication.py
from rest_framework.authentication import BaseAuthentication
from authenticated.models import UserToken
from rest_framework.exceptions import AuthenticationFailed
class LoingAuth(BaseAuthentication):
def authenticate(self, request):
token = request.query_params.get('token')
user_token = UserToken.objects.filter(userToken=token).first()
if not user_token:
raise AuthenticationFailed("请先登录")
return user_token.user, token
views.py
from django.shortcuts import render
# Create your views here.
from rest_framework.viewsets import GenericViewSet
from authenticated.models import User,UserToken
from rest_framework.response import Response
from rest_framework.decorators import action
import uuid
from rest_framework.viewsets import ModelViewSet
from authenticated.models import Book
from authenticated.serializer import BookSerializer
from authenticated.authentication import LoingAuth
class UserView(GenericViewSet):
@action(methods=['POST'], detail=False)
def login(self,request):
username = request.data.get("username")
password = request.data.get("password")
user = User.objects.filter(username=username, password=password).first()
if not user:
return Response({"code":1001,"msg":"用户名或密码错误"})
token = str(uuid.uuid4())
# userToken表中有就更新，没有就创建
#UserToken.objects.update_or_create(user=user, defaults={'token': token})
UserToken.objects.update_or_create(user=user, defaults={'userToken': token})
return Response({"code":1000,"msg":"登录成功",'token': token})
class BookView(ModelViewSet):
# 只对BookView单独进行认证(局部配置)
authentication_classes = [LoingAuth,]
queryset = Book.objects.all()
serializer_class = BookSerializer
路由urls.py
from django.contrib import admin
from django.urls import path,include
from authenticated import views
from rest_framework import routers
router = routers.SimpleRouter()
router.register('user',views.UserView, "user")
router.register('books', views.BookView,"books")
urlpatterns = [
path('admin/', admin.site.urls),
path('', include(router.urls))
]
全局配置settings.py
REST_FRAMEWORK = {
"DEFAULT_AUTHENTICATION_CLASSES":["authenticated.authentication.LoingAuth"],
}
# authenticated.authentication.LoingAuth 为写的认证的类
# 全局配置后局部配置的就可以取消了。
# 但是全局配置后如果有些类不想让它有认证，比如登录接口，它不能有认证否则就死循环了。
# 全局配置后，单独取消某一个接口的认证：
class UserView(ViewSet):
authentication_classes = [] # 让它等于空就可以了。
2. 权限
所有的接口必须登录后才能访问(给每个视图加认证)，登录成功后如果是普通用户则只可查看全部或单条数据。如果想要增删改必须是管理员或超级管理员。
演示可以把五个接口写成两个视图：
在应用目录下创建permission.py文件
permission.py
from rest_framework.permissions import BasePermission
class userPermission(BasePermission):
def has_permission(self, request, view):
user_type = request.user.user_type
# (1, "超级管理员"),(2,"管理员"),(3,"普通用户")，如果小于3说明是管理或超管用户
if user_type <3:
return True
else:
return False
视图views.py
from rest_framework.viewsets import GenericViewSet
from authenticated.models import User, UserToken
from authenticated.models import Book
from authenticated.serializer import BookSerializer
from authenticated.authentication import LoingAuth
from rest_framework.mixins import CreateModelMixin, ListModelMixin, DestroyModelMixin, UpdateModelMixin, \
RetrieveModelMixin
#用户登录接口此处省略(见上面1.2认证)
# 查看全部和单条。只要登录了谁都可以访问
class BookView(GenericViewSet, ListModelMixin, RetrieveModelMixin):
authentication_classes = [LoingAuth, ]
queryset = Book.objects.all()
serializer_class = BookSerializer
# 只有管理和超管用户可以 创建、修改、新增
from authenticated.permission import userPermission
class BookDetailView(GenericViewSet, CreateModelMixin, UpdateModelMixin, DestroyModelMixin):
authentication_classes = [LoingAuth]
permission_classes = [userPermission]
queryset = Book.objects.all()
serializer_class = BookSerializer
路由 urls.py:
from django.contrib import admin
from django.urls import path,include
from authenticated import views
from rest_framework import routers
router = routers.SimpleRouter()
router.register('user',views.UserView, "user")
router.register('books', views.BookView,"books")
router.register('bookdetail', views.BookDetailView,"bookdetail")
urlpatterns = [
path('admin/', admin.site.urls),
path('', include(router.urls))
]
全局配置settings.py
REST_FRAMEWORK = {
"DEFAULT_PERMISSION_CLASSES":["authenticated.permission.userPermission"],
}
# authenticated.permission.userPermission 为写的权限的类
# 全局配置后局部配置的就可以取消了。
# 全局配置后，单独取消某一个接口的权限：
class UserView(ViewSet):
permission_classes = [] # 让它等于空就可以了。
普通用户访问的时候会报没有权限
2.1 权限总结：
两个视图：
BookView：获取所有，获取单条
BookDetailView：删除，修改，新增
上面两个视图都需要登录：authentication_classes = [LoginAuth, ]
BookDetailView必须有权限才能，加了一个权限，permission_classes = [UserPermission, ]
编写权限步骤
第一步：写一个类，继承BasePermission，重写has_permission，判断如果有权限，返回True，如果没有权限，返回False
第二步：局部配置和全局配置
局部配置
class BookDetailView(GenericViewSet, CreateModelMixin, DestroyModelMixin, UpdateModelMixin):
permission_classes = [UserPermission, ]
全局配置
settings.py
REST_FRAMEWORK={
"DEFAULT_PERMISSION_CLASSES":["authenticated.permission.userPermission",]
}
3. 频率
限制访问的频率
在应用目录创建throttle.py文件用来限制频率
throttle.py
from rest_framework.throttling import SimpleRateThrottle
class IpThrottle(SimpleRateThrottle):
scope = 'min_3' # 在settings.py定义给哪个类限制的频率
# get_cache_key 返回什么就以什么做限制，现在是以IP做限制
def get_cache_key(self, request, view):
return request.META.get('REMOTE_ADDR') # 返回的是客户端的IP，以IP做限制
# return request.user.id # 返回已经登录的用户的id，以用户id做限制
views.py
from authenticated.throttle import IpThrottle
# 查看全部和单条。只要登录了谁都可以访问
class BookView(GenericViewSet, ListModelMixin, RetrieveModelMixin):
authentication_classes = [LoingAuth, ]
throttle_classes = [IpThrottle] # 访问BookView类做限制
queryset = Book.objects.all()
serializer_class = BookSerializer
settings.py
REST_FRAMEWORK = {
"DEFAULT_THROTTLE_RATES":{
'min_3':'3/m',
},
}
# min_3 就是上面throttle.py.IpThrottle里scope定义的，这个一定要和scope定义的一致
# 3/m 每一分钟访问3次 ('s', 'sec', 'm', 'min', 'h', 'hour', 'd', 'day')
# 如果throttle.py.IpThrottle里还有别的限制的类，如果scope也是为min_3，那它也是每分钟访问3次的限制
超过3次就会报错:
上面的配置为局部配置，也可以设置全局配置
settings.py
REST_FRAMEWORK = {
"DEFAULT_THROTTLE_CLASSES" : ["authenticated.throttle.IpThrottle"], # 全局配置
"DEFAULT_THROTTLE_RATES":{
'min_3':'3/m',
},
}
# 同样设置了全局，局部的throttle_classes = [IpThrottle]就可以不写了
# 如果只是某个类禁用:
throttle_classes = []
3.1 频率总结
步骤:
第一步：写一个类，继承SimpleRateThrottle，重写类属性：scope，和get_cache_key方法
get_cache_key返回什么，就以什么做限制，
scope配置文件中要用
第二步：在配置文件中配置
settings.py中
REST_FRAMEWORK = {
"DEFAULT_THROTTLE_RATES":{
'min_3':'3/m', # minute_3是scope的字符串，一分钟访问3次
},
}
第三步： 使用
1. 局部使用--》视图类中
class BookView(GenericViewSet, ListModelMixin, RetrieveModelMixin):
throttle_classes = [IPThrottle]
2. 全局使用--配置文件中
settings.py中
REST_FRAMEWORK = {
"DEFAULT_THROTTLE_CLASSES" : ["authenticated.throttle.IpThrottle"],
"DEFAULT_THROTTLE_RATES":{
'min_3':'3/m', # minute_3是scope的字符串，一分钟访问3次
},
}
