drf 认证流程解析

目录

• 认证
  • 简单使用：
  • 源码：
  • 流程分析：

认证

用于必须登录后才能访问否个视图。

简单使用：

url.py

from django.conf.urls import url,include
from django.contrib import admin
from . import views
urlpatterns = [
    url(r'^login/$', views.LoginView.as_view()),
    url(r'^order/$', views.OrderView.as_view()),
    url(r'^user/$', views.UserView.as_view()),
]

views.py

import uuid
from django.shortcuts import render
from django.views import View
from django.views.decorators.csrf import csrf_exempt
from django.utils.decorators import method_decorator
from rest_framework.versioning import URLPathVersioning
from rest_framework.views import APIView
from rest_framework.response import Response

from . import models

class LoginView(APIView):

    def post(self,request,*args,**kwargs):
        user_object = models.UserInfo.objects.filter(**request.data).first()
        if not user_object:
            return Response('登录失败')
        random_string = str(uuid.uuid4())	# 产生随机字符串
        user_object.token = random_string	#  保存在数据库
        user_object.save()
        return Response(random_string)

    
class MyAuthentication:
    def authenticate(self, request):
        # 重写这个方法
        """
        Authenticate the request and return a two-tuple of (user, token).
        """
        token = request.query_params.get('token')
        # 获取请求携带的token,然后获取用户对象
        user_object = models.UserInfo.objects.filter(token=token).first()
        if user_object:
            return (user_object,token)
        return (None,None)

    
class OrderView(APIView):
    authentication_classes = [MyAuthentication, ]
    # 需要登录认证的视图，设置类列表
    def get(self,request,*args,**kwargs):
        print(request.user)		# 获取用户对象
        print(request.auth)		# 获取token
        return Response('order')

class UserView(APIView):
    authentication_classes = [MyAuthentication,]
    def get(self,request,*args,**kwargs):
        print(request.user)
        print(request.auth)
        return Response('user')

源码：

class APIView(View):
    authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES
    
	def dispatch(self, request, *args, **kwargs):
        """
        `.dispatch()` is pretty much the same as Django's regular dispatch,
        but with extra hooks for startup, finalize, and exception handling.
        """
        # ###################### 第一步 ###########################
        """
        request,是django的request，它的内部有：request.GET/request.POST/request.method
        args,kwargs是在路由中匹配到的参数，如：
            url(r'^order/(\d+)/(?P<version>\w+)/$', views.OrderView.as_view()),
            http://www.xxx.com/order/1/v2/
        """
        self.args = args
        self.kwargs = kwargs


        """
        request = 生成了一个新的request对象，此对象的内部封装了一些值。
        request = Request(request)
            - 内部封装了 _request = 老的request
            - 内部封装了 authenticators = [MyAuthentication(), ] 对象类列表
        """
        request = self.initialize_request(request, *args, **kwargs)
        self.request = request

        
	def initialize_request(self, request, *args, **kwargs):
        """
        Returns the initial request object.
        """
        parser_context = self.get_parser_context(request)

        return Request(
            request,
            parsers=self.get_parsers(),
            authenticators=self.get_authenticators(), # 认证[MyAuthentication(),]
            negotiator=self.get_content_negotiator(),
            parser_context=parser_context
        )

    
    def get_authenticators(self):
        """
        Instantiates and returns the list of authenticators that this view can use.
        """
        return [ auth() for auth in self.authentication_classes ]
    

def perform_authentication(self, request):

    request.user

会执行Request中def user()

def user(self):
	self._authenticate()
    
def _authenticate(self):
    for authenticator in self.authenticators:
        user_auth_tuple = authenticator.authenticate(self)	# 循环上面获取到的认证对象类列表，执行自定制的auhenticate()方法

流程分析：

1. 当前请求到来时，执行APIview dispatch方法，request = self.initialize_request()先进行新的request封装，其中封装了老request、认证类对象列表等。 
2. 然后执行 initial方法，先进行分页、再进行认证执行 perform_authentication()  --- request.user
3.执行Request中def user(), user中循环认证类对象列表，执行每个对象的 def authenticate()（重写的方法），有三种返回方式：	 
    - 元组:认证通过
    - None:进行下个类的认证
    - 主动抛出异常:认证失败
下面两种方式可以触发第三步的认证：
	request.user 	能够获取当前登录用户对象
	request.auth	获取toke