DRF-源码解析-2-认证流程，drf的认证源码，drf的认证流程
一、代码准备
视图：
class TestAPIView(APIView):
authentication_classes=[MyJWTAuthentication]
def get(self,request)
return Respponse({'code':200,'msg':'测试通过'})
路由：
path('test/',views.TestAPIView.as_view())
请求方式：GET
认证的配置：
#1、全局配置：settings.py
REST_FRAMEWORK = {
#1、全局认证
'DEFAULT_AUTHENTICATION_CLASSES':['authen.authentication.MyJWTAuthentication'],
}
#2、局部配置：视图类的类变量
class TestAPIView(APIView):
authentication_classes=[MyJWTAuthentication]
token:
import jwt
from django.conf import settings
import time
def create_token(user_id: int, timeout=None):
'''
:param user_id: 传递用户的id
:param timeout: token有效时间，默认是一天
:return:
'''
has_exp = hasattr(settings,'JWT_EXPIRATION_DELTA')
if has_exp:
jwt_exp = getattr(settings,'JWT_EXPIRATION_DELTA')
else:
jwt_exp = 24*60*60
if timeout == None:
#没有指定过期时间，就使用配置的时间戳
timeout = jwt_exp
elif type(timeout) != int:
#传递的类型有误，使用配置中的时间戳
timeout = jwt_exp
payload = {'user_id': user_id}
salt = settings.SECRET_KEY # 加密的盐
# 构造header
headers = {
'type': 'jwt',
'alg': 'HS256'
}
now_datetime = time.time()
payload['exp'] = now_datetime + timeout # token过期时间,时间戳
# print(payload)
token = jwt.encode(payload=payload, key=salt, algorithm="HS256", headers=headers).decode('utf-8')
return token
认证类的书写：
from rest_framework.authentication import BaseAuthentication
class MyJWTAuthentication(BaseAuthentication):
def authenticate(self, request):
# 获取token
token = request.META.get("HTTP_TOKNE") # 从请求头中获取
if not token:
token = request.COOKIES.get('token') # 从cookies中获取token
if not token:
msg = '没有携带token'
raise AuthenticationFailed({'code':410,'error':'没有携带token'})
'''
1、切割
2、解密第二段/判断过期
3、验证第三段合法性
'''
# 导入settings中的字符串做盐
salt = settings.SECRET_KEY
payload = None
try:
payload = jwt.decode(token, salt, True)
#获取用户信息
user = models.UserModel.objects.filter(id=payload.get('user_id'),is_enable=True).first()
if user:
return (user, token)
# request.user,request.auth
else:
raise AuthenticationFailed({'code':410,'error':'token有问题'})
except exceptions:
msg = 'token有问题，请重新登录'
raise AuthenticationFailed({'code': 410, 'error': msg})
二、认证具体流程
1、TestAPIView的as_view方法，当前实例对象没有，找父类的APIView的as_view
@classmethod
def as_view(cls, **initkwargs):
#1、调用APIView父类的as_view方法
view = super().as_view(**initkwargs)
view.cls = cls
view.initkwargs = initkwargs
#2、去除掉csrf校验
return csrf_exempt(view)
2、APIView的as_view是调用父类View的as_view方法
@classonlymethod
def as_view(cls, **initkwargs):
def view(request, *args, **kwargs):
self = cls(**initkwargs)
self.setup(request, *args, **kwargs)
if not hasattr(self, 'request'):
raise AttributeError(
"%s instance has no 'request' attribute. Did you override "
"setup() and forget to call super()?" % cls.__name__
)
return self.dispatch(request, *args, **kwargs)
view.view_class = cls
view.view_initkwargs = initkwargs
return view
#返回的是闭包view，
#view的功能就是self.dispatch()方法
3、as_view主要返回闭包，关于self.dispatch()方法
4、self是TestAPIView , 没有dispatch方法，调用父类APIView的dispatch方法
#简化后的源码
def dispatch(self, request, *args, **kwargs):
#处理url中的参数
self.args = args
self.kwargs = kwargs
#构建drf的request对象
request = self.initialize_request(request, *args, **kwargs)
self.request = request
self.headers = self.default_response_headers # deprecate?
try:
#认证、权限、限流的执行
self.initial(request, *args, **kwargs)
#通过反射来执行TestAPIView中的get、post等方法
if request.method.lower() in self.http_method_names:
handler = getattr(self, request.method.lower(),
self.http_method_not_allowed)
else:
handler = self.http_method_not_allowed
#视图函数执行结果
response = handler(request, *args, **kwargs)
except Exception as exc:
response = self.handle_exception(exc)
self.response = self.finalize_response(request, response, *args, **kwargs)
return self.response
5、self.initialize_request，TestAPIView没有，调用APIView的initialize_request方法，构建drf的request对象
def initialize_request(self, request, *args, **kwargs):
"""
Returns the initial request object.
"""
parser_context = self.get_parser_context(request)
return Request(
request,
parsers=self.get_parsers(),
authenticators=self.get_authenticators(),#获取认证对象
negotiator=self.get_content_negotiator(),
parser_context=parser_context
)
5.1、self.get_authenticators()，TestAPIView没有，调用父类的APIView的get_authenticators
def get_authenticators(self):
return [auth() for auth in self.authentication_classes]
5.2、 self.authentication_classes ： self=TestAPIView的实例对象
-
如果TestAPIView中设置了authentication_classes 成员变量
-
class TestAPIView(APIView): authentication_classes=[MyJWTAuthentication] def get(self,request) return Respponse({'code':200,'msg':'测试通过'})
-
-
如果TestAPIView没有设置，就去父类APIView中获取
-
class APIView(View): authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES #这里就是去settings.py中获取配置 REST_FRAMEWORK = { #1、全局认证 'DEFAULT_AUTHENTICATION_CLASSES':['authen.authentication.MyJWTAuthentication'], }
-
5.3、获取到的就是[认证类(),]
5.4、新的requuest的初始化：drf的request对象，其实例变量authenticators=[认证类()，]
class Request:
def __init__(self, request, parsers=None, authenticators=None,
negotiator=None, parser_context=None):
self._request = request
self.authenticators = authenticators or ()
6、self.initial(request,)，TestAPIView中没有，找APIView的initial方法，
def initial(self, request, *args, **kwargs):
#认证、权限、限流
self.perform_authentication(request)
self.check_permissions(request)
self.check_throttles(request)
7、self.perform_authentication(request)， TestAPIView中没有，找APIView的perform_authentication方法
#request 是drf的request，调用request的user
def perform_authentication(self, request):
request.user
8、request是drf创建的request对象，调用request.user方法（此后，就是去找Request类了）
from rest_framework.request import Request
@property
def user(self):
if not hasattr(self, '_user'):
with wrap_attributeerrors():
self._authenticate()
return self._user
-
在实例化request对象时，初始化中没有_user的成员变量
-
执行self._authenticate()方法，request的self._authenticate()方法
-
#self=request def _authenticate(self): #去Request的authenticators 实例变量中获取认证类对象类别 for authenticator in self.authenticators: try: #执行authenticate方法，返回元组，（user,token） user_auth_tuple = authenticator.authenticate(self) except exceptions.APIException: self._not_authenticated() raise #认证通过 if user_auth_tuple is not None: self._authenticator = authenticator self.user, self.auth = user_auth_tuple return #认证不通过时，就是给request.user,request.auth 设置匿名用户了 self._not_authenticated()
-
9、认证时，token没有异常：就进入下一步了
def dispatch(self, request, *args, **kwargs):
#处理url中的参数
self.args = args
self.kwargs = kwargs
#构建drf的request对象
request = self.initialize_request(request, *args, **kwargs)
self.request = request
self.headers = self.default_response_headers # deprecate?
try:
#认证、权限、限流的执行
self.initial(request, *args, **kwargs)
#通过反射来执行TestAPIView中的get、post等方法
if request.method.lower() in self.http_method_names:
handler = getattr(self, request.method.lower(),
self.http_method_not_allowed)
else:
handler = self.http_method_not_allowed
#视图函数执行结果
response = handler(request, *args, **kwargs)
except Exception as exc:
response = self.handle_exception(exc)
self.response = self.finalize_response(request, response, *args, **kwargs)
return self.response
10、通过反射，从TestAPIView中获取到get方法，执行get方法，获取返回值。