drf-jwt手动签发与校验与drf小组件

概述签发token 源码入口 """前提: 给一个局部禁用了所有 认证与权限 的视图类发送用户信息得到token, 其实就是登陆接口1) rest_framework_jwt.views.ObtainJSONWebToken 的父类 JSONWebTokenAPIView 的 post方法 接受有username, password的post请求2) pos 签发token 源码入口

"""前提: 给一个局部禁用了所有 认证与权限 的视图类发送用户信息得到token,其实就是登陆接口1) rest_framework_jwt.vIEws.ObtainjsONWebToken 的父类 JsONWebTokenAPIVIEw 的 post方法             接受有username,password的post请求2) post方法将请求数据交给 rest_framework_jwt.serializer.JsONWebTokenSerializer 处理             完成数据的校验,会走序列化类的 全局钩子校验规则,校验得到登录用户并签发token存储在序列化对象中"""

核心源码：rest_framework_jwt.serializer.JsONWebTokenSerializer的valIDate(self,attrs)方法

def valIDate(self,attrs):    # 账号密码字典    credentials = {        self.username_fIEld: attrs.get(self.username_fIEld),‘password‘: attrs.get(‘password‘)    }    if all(credentials.values()):        # 签发token第1步：用账号密码得到user对象        user = authenticate(**credentials)        if user:            if not user.is_active:                msg = _(‘User account is Disabled.‘)                raise serializers.ValIDationError(msg)            # 签发token第2步：通过user得到payload，payload包含着用户信息与过期时间            payload = jwt_payload_handler(user)            # 在视图类中，可以通过 序列化对象.object.get(‘user‘或者‘token‘) 拿到user和token             return {                # 签发token第3步：通过payload签发出token                ‘token‘: jwt_encode_handler(payload),‘user‘: user            }        else:            msg = _(‘Unable to log in with provIDed credentials.‘)            raise serializers.ValIDationError(msg)    else:        msg = _(‘Must include "{username_fIEld}" and "password".‘)        msg = msg.format(username_fIEld=self.username_fIEld)        raise serializers.ValIDationError(msg)

手动签发token逻辑

"""1) 通过username,password得到user对象2) 通过user对象生成payload: jwt_payload_handler(user) => payload      from rest_framework_jwt.serializers import jwt_payload_handler3) 通过payload签发token: jwt_encode_handler(payload) => token      from rest_framework_jwt.serializers import jwt_encode_handler"""

 

校验token 源码入口

# 前提：访问一个配置了jwt认证规则的视图类，就需要提交认证字符串token，在认证类中完成token的校验# 1）rest_framework_jwt.authentication.JsONWebTokenAuthentication 的 父类 BaseJsONWebTokenAuthentication 的 authenticate 方法#        请求头拿认证信息jwt-token => 通过反爬小规则确定有用的token => payload => user

核心源码：rest_framework_jwt.authentication.BaseJsONWebTokenAuthentication的authenticate(self,request)方法

def authenticate(self,request):    """    Returns a two-tuple of `User` and token if a valID signature has been    supplIEd using JWT-based authentication.  Otherwise returns `None`.    """    # 带有反爬小规则的获取token：前台必须按 "jwt token字符串" 方式提交    # 校验user第1步：从请求头 http_AUTHORIZATION 中拿token，并提取    jwt_value = self.get_jwt_value(request)    # 游客    if jwt_value is None:        return None    # 校验    try:        # 校验user第2步：token => payload        payload = jwt_decode_handler(jwt_value)    except jwt.ExpiredSignature:        msg = _(‘Signature has expired.‘)        raise exceptions.AuthenticationFailed(msg)    except jwt.DecodeError:        msg = _(‘Error deCoding signature.‘)        raise exceptions.AuthenticationFailed(msg)    except jwt.InvalIDTokenError:        raise exceptions.AuthenticationFailed()    # 校验user第3步：token => payload    user = self.authenticate_credentials(payload)    return (user,jwt_value)

 

手动校验token逻辑

# 1）从请求头中获取token# 2）根据token解析出payload：jwt_decode_handler(token) => payloay#        from rest_framework_jwt.authentication import jwt_decode_handler# 3）根据payload解析出user：self.authenticate_credentials(payload) => user#        继承drf-jwt的BaseJsONWebTokenAuthentication，拿到父级的authenticate_credentials方法

 

案例：实现多方式登陆签发token models.py

from django.db import modelsfrom django.contrib.auth.models import AbstractUserclass User(AbstractUser):    mobile = models.CharFIEld(max_length=11,unique=True)    class Meta:        db_table = ‘API_user‘        verbose_name = ‘用户表‘        verbose_name_plural = verbose_name    def __str__(self):        return self.username

serializers.py

from rest_framework import serializersfrom . import modelsimport re# 拿到前台token的两个函数： user => payload => token# from rest_framework_jwt.settings import API_settings# jwt_payload_handler = API_settings.JWT_PAYLOAD_HANDLER# jwt_encode_handler = API_settings.JWT_ENCODE_HANDLERfrom rest_framework_jwt.serializers import jwt_payload_handlerfrom rest_framework_jwt.serializers import jwt_encode_handler# 1) 前台提交多种登录信息都采用一个key，所以后台可以自定义反序列化字段进行对应# 2) 序列化类要处理序列化与反序列化，要在fIElds中设置model绑定的Model类所有使用到的字段# 3) 区分序列化字段与反序列化字段 read_only | write_only# 4) 在自定义校验规则中（局部钩子、全局钩子）校验数据是否合法、确定登录的用户、根据用户签发token# 5) 将登录的用户与签发的token保存在序列化类对象中class usermodelSerializer(serializers.ModelSerializer):    # 自定义反序列字段：一定要设置write_only，只参与反序列化，不会与model类字段映射    usr = serializers.CharFIEld(write_only=True)    pwd = serializers.CharFIEld(write_only=True)    class Meta:        model = models.User        fIElds = [‘usr‘,‘pwd‘,‘username‘,‘mobile‘,‘email‘]        # 系统校验规则        extra_kwargs = {            ‘username‘: {                ‘read_only‘: True            },‘mobile‘: {                ‘read_only‘: True            },‘email‘: {                ‘read_only‘: True            },}    def valIDate(self,attrs):        usr = attrs.get(‘usr‘)        pwd = attrs.get(‘pwd‘)        # 多方式登录：各分支处理得到该方式下对应的用户        if re.match(r‘[email protected]+‘,usr):            user_query = models.User.objects.filter(email=usr)        elif re.match(r‘1[3-9][0-9]{9}‘,usr):            user_query = models.User.objects.filter(mobile=usr)        else:            user_query = models.User.objects.filter(username=usr)        user_obj = user_query.first()        # 签发：得到登录用户，签发token并存储在实例化对象中        if user_obj and user_obj.check_password(pwd):            # 签发token，将token存放到 实例化类对象的token 名字中            payload = jwt_payload_handler(user_obj)            token = jwt_encode_handler(payload)            # 将当前用户与签发的token都保存在序列化对象中            self.user = user_obj            self.token = token            return attrs        raise serializers.ValIDationError({‘data‘: ‘数据有误‘})

vIEws.py

#实现多方式登陆签发token：账号、手机号、邮箱等登陆# 1) 禁用认证与权限组件# 2) 拿到前台登录信息，交给序列化类# 3) 序列化类校验得到登录用户与token存放在序列化对象中# 4) 取出登录用户与token返回给前台import refrom . import serializers,modelsfrom utils.response import APIResponsefrom rest_framework_jwt.serializers import jwt_payload_handlerfrom rest_framework_jwt.serializers import jwt_encode_handlerclass LoginAPIVIEw(APIVIEw):    # 1) 禁用认证与权限组件    authentication_classes = []    permission_classes = []    def post(self,request,*args,**kwargs):        # 2) 拿到前台登录信息，交给序列化类，规则：账号用usr传，密码用pwd传        user_ser = serializers.usermodelSerializer(data=request.data)        # 3) 序列化类校验得到登录用户与token存放在序列化对象中        user_ser.is_valID(raise_exception=True)        # 4) 取出登录用户与token返回给前台        return APIResponse(token=user_ser.token,results=serializers.usermodelSerializer(user_ser.user).data)    # "一根筋" 思考方式：所有逻辑都在视图类中处理    def my_post(self,**kwargs):        usr = request.data.get(‘usr‘)        pwd = request.data.get(‘pwd‘)        if re.match(r‘[email protected]+‘,usr):            user_query = models.User.objects.filter(mobile=usr)        else:            user_query = models.User.objects.filter(username=usr)        user_obj = user_query.first()        if user_obj and user_obj.check_password(pwd):            payload = jwt_payload_handler(user_obj)            token = jwt_encode_handler(payload)            return APIResponse(results={‘username‘: user_obj.username},token=token)        return APIResponse(data_msg=‘不可控错误‘)

 

案例：自定义认证反爬规则的认证类 authentications.py

import jwtfrom rest_framework_jwt.authentication import BaseJsONWebTokenAuthenticationfrom rest_framework_jwt.authentication import jwt_decode_handlerfrom rest_framework.exceptions import AuthenticationFailedclass JWTAuthentication(BaseJsONWebTokenAuthentication):    def authenticate(self,request):        jwt_token = request.Meta.get(‘http_AUTHORIZATION‘)        # 自定义校验规则：auth token jwt        token = self.parse_jwt_token(jwt_token)        if token is None:            return None        try:            # token => payload            payload = jwt_decode_handler(token)        except jwt.ExpiredSignature:            raise AuthenticationFailed(‘token已过期‘)        except:            raise AuthenticationFailed(‘非法用户‘)        # payload => user        user = self.authenticate_credentials(payload)        return (user,token)    # 自定义校验规则：auth token jwt，auth为前盐，jwt为后盐    def parse_jwt_token(self,jwt_token):        tokens = jwt_token.split()        if len(tokens) != 3 or tokens[0].lower() != ‘auth‘ or tokens[2].lower() != ‘jwt‘:            return None        return tokens[1]

vIEws.py

from rest_framework.vIEws import APIVIEwfrom utils.response import APIResponse# 必须登录后才能访问 - 通过了认证权限组件from rest_framework.permissions import IsAuthenticated# 自定义jwt校验规则from .authentications import JWTAuthenticationclass UserDetail(APIVIEw):    authentication_classes = [JWTAuthentication]    permission_classes = [IsAuthenticated]    def get(self,**kwargs):        return APIResponse(results={‘username‘: request.user.username})

 

群查接口各种筛选组件数据准备 models.py

class Car(models.Model):    name = models.CharFIEld(max_length=16,unique=True,verbose_name=‘车名‘)    price = models.DecimalFIEld(max_digits=10,decimal_places=2,verbose_name=‘价格‘)    brand = models.CharFIEld(max_length=16,verbose_name=‘品牌‘)    class Meta:        db_table = ‘API_car‘        verbose_name = ‘汽车表‘        verbose_name_plural = verbose_name    def __str__(self):        return self.name

admin.py

admin.site.register(models.Car)

serializers.py

class CarModelSerializer(serializers.ModelSerializer):    class Meta:        model = models.Car        fIElds = [‘name‘,‘price‘,‘brand‘]

vIEws.py

# Car的群查接口from rest_framework.generics import ListAPIVIEwclass CarListAPIVIEw(ListAPIVIEw):    queryset = models.Car.objects.all()    serializer_class = serializers.CarModelSerializer

urls.py

url(r‘^cars/$‘,vIEws.CarListAPIVIEw.as_vIEw()),

 

drf搜索过滤组件 vIEws.py

from rest_framework.generics import ListAPIVIEw# 第一步：drf的SearchFilter - 搜索过滤from rest_framework.filters import SearchFilterclass CarListAPIVIEw(ListAPIVIEw):    queryset = models.Car.objects.all()    serializer_class = serializers.CarModelSerializer    # 第二步：局部配置 过滤类 们（全局配置用DEFAulT_FILTER_BACKENDS）    filter_backends = [SearchFilter]    # 第三步：SearchFilter过滤类依赖的过滤条件 => 接口：/cars/?search=...    search_fIElds = [‘name‘,‘price‘]    # eg：/cars/?search=1，name和price中包含1的数据都会被查询出

 

drf排序过滤组件 vIEws.py

from rest_framework.generics import ListAPIVIEw# 第一步：drf的OrderingFilter - 排序过滤from rest_framework.filters import OrderingFilterclass CarListAPIVIEw(ListAPIVIEw):    queryset = models.Car.objects.all()    serializer_class = serializers.CarModelSerializer    # 第二步：局部配置 过滤类 们（全局配置用DEFAulT_FILTER_BACKENDS）    filter_backends = [OrderingFilter]    # 第三步：OrderingFilter过滤类依赖的过滤条件 => 接口：/cars/?ordering=...    ordering_fIElds = [‘pk‘,‘price‘]    # eg：/cars/?ordering=-price,pk，先按price降序，如果出现price相同，再按pk升序

 

drf基础分页组件 pagenations.py

from rest_framework.pagination import PageNumberPaginationclass MyPageNumberPagination(PageNumberPagination):    # ?page=页码    page_query_param = ‘page‘    # ?page=页面 下默认一页显示的条数    page_size = 3    # ?page=页面&page_size=条数 用户自定义一页显示的条数    page_size_query_param = ‘page_size‘    # 用户自定义一页显示的条数最大限制：数值超过5也只显示5条    max_page_size = 5

vIEws.py

from rest_framework.generics import ListAPIVIEwclass CarListAPIVIEw(ListAPIVIEw):    # 如果queryset没有过滤条件，就必须 .all()，不然分页会出问题    queryset = models.Car.objects.all()    serializer_class = serializers.CarModelSerializer        # 分页组件 - 给视图类配置分页类即可 - 分页类需要自定义，继承drf提供的分页类即可    pagination_class = pagenations.MyPageNumberPagination

@H_191_1419@ 总结

以上是内存溢出为你收集整理的drf-jwt手动签发与校验与drf小组件全部内容，希望文章能够帮你解决drf-jwt手动签发与校验与drf小组件所遇到的程序开发问题。

如果觉得内存溢出网站内容还不错，欢迎将内存溢出网站推荐给程序员好友。