Django Rest Framework源码剖析(一)—–认证详解编程语言

  pip install djangorestframework 
  pip install markdown       # Markdown support for the browsable API. 
  pip install django-filter  # Filtering support

from django.views.decorators.csrf import csrf_exempt 
 
@csrf_exempt 
def index(request): 
    pass

###方式一 
from django.shortcuts import render,HttpResponse 
from django.views.decorators.csrf import csrf_exempt,csrf_protect 
from django.utils.decorators import method_decorator 
from django.views import View 
 
class Myview(View): 
    @method_decorator(csrf_exempt)    #必须将装饰器写在dispatch上，单独加不生效 
    def dispatch(self, request, *args, **kwargs): 
        return super(Myview,self).dispatch(request,*args,**kwargs) 
    def get(self): 
        return HttpResponse('get') 
 
    def post(self): 
        return HttpResponse('post') 
 
    def put(self): 
        return HttpResponse('put')

from django.shortcuts import render,HttpResponse 
from django.views.decorators.csrf import csrf_exempt,csrf_protect 
from django.utils.decorators import method_decorator 
from django.views import View 
 
 
@method_decorator(csrf_exempt,name='dispatch')##name参数指定是dispatch方法 
class Myview(View): 
     
    def dispatch(self, request, *args, **kwargs): 
        return super(Myview,self).dispatch(request,*args,**kwargs) 
    def get(self): 
        return HttpResponse('get') 
 
    def post(self): 
        return HttpResponse('post') 
 
    def put(self): 
        return HttpResponse('put')

from django.db import models 
 
class UserInfo(models.Model): 
    user_type_choice = ( 
        (1,"普通用户"), 
        (2,"会员"), 
    ) 
    user_type = models.IntegerField(choices=user_type_choice) 
    username = models.CharField(max_length=32,unique=True) 
    password = models.CharField(max_length=64) 
 
 
class UserToken(models.Model): 
    user = models.OneToOneField(to=UserInfo) 
    token = models.CharField(max_length=64)

from django.conf.urls import url 
from django.contrib import admin 
from app01 import views 
 
urlpatterns = [ 
 
    url(r'^api/v1/auth', views.AuthView.as_view()), 
    url(r'^api/v1/order', views.OrderView.as_view()), 
]

from django.shortcuts import  HttpResponse 
from django.http import JsonResponse 
from rest_framework.views import APIView 
from rest_framework.authentication import BaseAuthentication 
from . import models 
from rest_framework import exceptions 
import hashlib 
import time 
class Authentication(BaseAuthentication): 
""" 
认证类 
""" 
def authenticate(self, request): 
token = request._request.GET.get("token") 
toke_obj = models.UserToken.objects.filter(token=token).first() 
if not toke_obj: 
raise exceptions.AuthenticationFailed("用户认证失败") 
return (toke_obj.user, toke_obj)  # 这里返回值一次给request.user,request.auth 
def authenticate_header(self, val): 
pass 
def md5(user): 
ctime = str(time.time()) 
m = hashlib.md5(bytes(user,encoding="utf-8")) 
m.update(bytes(ctime,encoding="utf-8")) 
return m.hexdigest() 
class AuthView(APIView): 
"""登陆认证""" 
def dispatch(self, request, *args, **kwargs): 
return super(AuthView, self).dispatch(request, *args, **kwargs) 
def get(self, request, *args, **kwargs): 
return HttpResponse('get') 
def post(self, request, *args, **kwargs): 
ret = {'code': 1000, 'msg': "登录成功"} 
try: 
user = request._request.POST.get("username") 
pwd = request._request.POST.get("password") 
obj = models.UserInfo.objects.filter(username=user, password=pwd).first() 
if not obj: 
ret['code'] = 1001 
ret['msg'] = "用户名或密码错误" 
else: 
token = md5(user) 
models.UserToken.objects.update_or_create(user=obj, defaults={"token": token}) 
ret['token'] = token 
except Exception as e: 
ret['code'] = 1002 
ret['msg'] = "请求异常" 
return JsonResponse(ret) 
class OrderView(APIView): 
'''查看订单''' 
authentication_classes = [Authentication,]    #添加认证 
def get(self,request,*args,**kwargs): 
#request.user 
#request.auth 
ret = {'code':1000,'msg':"你的订单已经完成",'data':"买了一个mac"} 
return JsonResponse(ret,safe=True)

http://127.0.0.1:8000/api/v1/order?token=63743076dfaefa632f6acb302cf90400 
###返回结果 
{"code": 1000, "msg": "/u4f60/u7684/u8ba2/u5355/u5df2/u7ecf/u5b8c/u6210", "data": "/u4e70/u4e86/u4e00/u4e2amac"}

@classmethod 
def as_view(cls, **initkwargs): 
""" 
Store the original class on the view function. 
This allows us to discover information about the view when we do URL 
reverse lookups.  Used for breadcrumb generation. 
""" 
if isinstance(getattr(cls, 'queryset', None), models.query.QuerySet): 
def force_evaluation(): 
raise RuntimeError( 
'Do not evaluate the `.queryset` attribute directly, ' 
'as the result will be cached and reused between requests. ' 
'Use `.all()` or call `.get_queryset()` instead.' 
) 
cls.queryset._fetch_all = force_evaluation 
view = super(APIView, cls).as_view(**initkwargs)   #执行父类as_view()方法 
view.cls = cls 
view.initkwargs = initkwargs 
# Note: session based authentication is explicitly CSRF validated, 
# all other authentication is CSRF exempt. 
return csrf_exempt(view)

    def as_view(cls, **initkwargs): 
""" 
Main entry point for a request-response process. 
""" 
for key in initkwargs: 
if key in cls.http_method_names: 
raise TypeError("You tried to pass in the %s method name as a " 
"keyword argument to %s(). Don't do that." 
% (key, cls.__name__)) 
if not hasattr(cls, key): 
raise TypeError("%s() received an invalid keyword %r. as_view " 
"only accepts arguments that are already " 
"attributes of the class." % (cls.__name__, key)) 
def view(request, *args, **kwargs): 
self = cls(**initkwargs) 
if hasattr(self, 'get') and not hasattr(self, 'head'): 
self.head = self.get 
self.request = request 
self.args = args 
self.kwargs = kwargs 
return self.dispatch(request, *args, **kwargs) 
view.view_class = cls 
view.view_initkwargs = initkwargs 
# take name and docstring from class 
update_wrapper(view, cls, updated=()) 
# and possible attributes set by decorators 
# like csrf_exempt from dispatch 
update_wrapper(view, cls.dispatch, assigned=()) 
return view

    def dispatch(self, request, *args, **kwargs): 
""" 
`.dispatch()` is pretty much the same as Django's regular dispatch, 
but with extra hooks for startup, finalize, and exception handling. 
""" 
self.args = args 
self.kwargs = kwargs 
request = self.initialize_request(request, *args, **kwargs)  #对django原始的request进行封装，返回Request对象(新的对象)。 
self.request = request 
self.headers = self.default_response_headers  # deprecate? 
try: 
self.initial(request, *args, **kwargs)  #这里request参数实则是Request对象 
# Get the appropriate handler method 
if request.method.lower() in self.http_method_names: 
handler = getattr(self, request.method.lower(), 
self.http_method_not_allowed) 
else: 
handler = self.http_method_not_allowed 
response = handler(request, *args, **kwargs) 
except Exception as exc: 
response = self.handle_exception(exc) 
self.response = self.finalize_response(request, response, *args, **kwargs) 
return self.response

    def initialize_request(self, request, *args, **kwargs): 
""" 
Returns the initial request object. 
""" 
parser_context = self.get_parser_context(request) 
return Request(      #实例化Request类， 
request,         #django原始的request对象，封装到Request中变成self._request　　 
parsers=self.get_parsers(), 
authenticators=self.get_authenticators(),  #开始认证流程 
negotiator=self.get_content_negotiator(), 
parser_context=parser_context 
)

 def get_authenticators(self): 
""" 
Instantiates and returns the list of authenticators that this view can use. 
""" 
return [auth() for auth in self.authentication_classes] #列表生成式返回认证类的对象列表

class APIView(View): 
# The following policies may be set at either globally, or per-view. 
renderer_classes = api_settings.DEFAULT_RENDERER_CLASSES 
parser_classes = api_settings.DEFAULT_PARSER_CLASSES 
authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES  #默认认证配置 
throttle_classes = api_settings.DEFAULT_THROTTLE_CLASSES 
permission_classes = api_settings.DEFAULT_PERMISSION_CLASSES 
content_negotiation_class = api_settings.DEFAULT_CONTENT_NEGOTIATION_CLASS 
metadata_class = api_settings.DEFAULT_METADATA_CLASS 
versioning_class = api_settings.DEFAULT_VERSIONING_CLASS

    def initial(self, request, *args, **kwargs): 
""" 
Runs anything that needs to occur prior to calling the method handler. 
""" 
self.format_kwarg = self.get_format_suffix(**kwargs) 
# Perform content negotiation and store the accepted info on the request 
neg = self.perform_content_negotiation(request) 
request.accepted_renderer, request.accepted_media_type = neg 
# Determine the API version, if versioning is in use. 
version, scheme = self.determine_version(request, *args, **kwargs) 
request.version, request.versioning_scheme = version, scheme 
# Ensure that the incoming request is permitted 
        self.perform_authentication(request)  #实现认证 
self.check_permissions(request) 
self.check_throttles(request)

class Request(object): 
""" 
Wrapper allowing to enhance a standard `HttpRequest` instance. 
Kwargs: 
- request(HttpRequest). The original request instance. 
- parsers_classes(list/tuple). The parsers to use for parsing the 
request content. 
- authentication_classes(list/tuple). The authentications used to try 
authenticating the request's user. 
""" 
def __init__(self, request, parsers=None, authenticators=None, 
negotiator=None, parser_context=None): 
assert isinstance(request, HttpRequest), ( 
'The `request` argument must be an instance of ' 
'`django.http.HttpRequest`, not `{}.{}`.' 
.format(request.__class__.__module__, request.__class__.__name__) 
) 
self._request = request      #django原生的request封装为_request 
self.parsers = parsers or () 
self.authenticators = authenticators or () 
self.negotiator = negotiator or self._default_negotiator() 
self.parser_context = parser_context 
self._data = Empty 
self._files = Empty 
self._full_data = Empty 
self._content_type = Empty 
self._stream = Empty 
#### 
    @property 
def user(self): 
""" 
Returns the user associated with the current request, as authenticated 
by the authentication classes provided to the request. 
""" 
if not hasattr(self, '_user'): 
with wrap_attributeerrors(): 
self._authenticate() #下hi ing 
return self._user

    def _authenticate(self): 
""" 
Attempt to authenticate the request using each authentication instance 
in turn. 
""" 
for authenticator in self.authenticators: 
try:

 　　　　　　　　　#执行认证类的authenticate方法 
#这里分三种情况 
#1.如果authenticate方法抛出异常，self._not_authenticated()执行 
#2.有返回值，必须是元组：（request.user,request.auth） 
#3.返回None，表示当前认证不处理，等下一个认证来处理

                user_auth_tuple = authenticator.authenticate(self) 
except exceptions.APIException: 
self._not_authenticated() 
raise 
if user_auth_tuple is not None: 
self._authenticator = authenticator 
self.user, self.auth = user_auth_tuple  #返回值对应示例中的token_obj.user和token_obj 
return 
self._not_authenticated()

def _not_authenticated(self): 
""" 
Set authenticator, user & authtoken representing an unauthenticated request. 
Defaults are None, AnonymousUser & None. 
""" 
self._authenticator = None 
if api_settings.UNAUTHENTICATED_USER: 
self.user = api_settings.UNAUTHENTICATED_USER()   #匿名用户配置，默认返回AnonymousUser 
else: 
self.user = None 
if api_settings.UNAUTHENTICATED_TOKEN: 
self.auth = api_settings.UNAUTHENTICATED_TOKEN()  #None 
else: 
self.auth = None

api_settings = APISettings(None, DEFAULTS, IMPORT_STRINGS) 
def reload_api_settings(*args, **kwargs): 
setting = kwargs['setting'] 
if setting == 'REST_FRAMEWORK':  #项目中settings.py的key 
api_settings.reload() 
setting_changed.connect(reload_api_settings)

#全局认证配置 
REST_FRAMEWORK = { 
"DEFAULT_AUTHENTICATION_CLASSES":['API.utils.auth.Authentication',]   #其中写认证的类的路径，不要在views中，这里我放在了utils目录下auth.py中 
}

authentication_classes = []    #authentication_classes为空，代表不需要认证

REST_FRAMEWORK = { 
"DEFAULT_AUTHENTICATION_CLASSES":['API.utils.auth.Authentication',]，  #其中写认证的类的路径，不要在views中，这里我放在了utils目录下auth.py中 
    "UNAUTHENTICATED_USER": lambda:"匿名"，#匿名用户配置，只需要函数或类的对应的返回值，对应request.user="匿名"
"UNAUTHENTICATED_token": None，#匿名token，只需要函数或类的对应的返回值，对应request.auth=None

 
}

class BaseAuthentication(object): 
""" 
All authentication classes should extend BaseAuthentication. 
""" 
def authenticate(self, request): 
""" 
Authenticate the request and return a two-tuple of (user, token). 
""" 
raise NotImplementedError(".authenticate() must be overridden.") 
def authenticate_header(self, request): 
""" 
Return a string to be used as the value of the `WWW-Authenticate` 
header in a `401 Unauthenticated` response, or `None` if the 
authentication scheme should return `403 Permission Denied` responses. 
""" 
pass

##路径:rest_framework.authentication 
 
BasicAuthentication  #基于浏览器进行认证 
SessionAuthentication #基于django的session进行认证 
RemoteUserAuthentication #基于django admin中的用户进行认证，这也是官网的示例 
TokenAuthentication #基于drf内部的token认证

#全局认证 
REST_FRAMEWORK = { 
"DEFAULT_AUTHENTICATION_CLASSES":['API.utils.auth.Authentication',] 
} 
#局部认证 
authentication_classes = [BaseAuthentication,] 
#是某个视图不进行认证 
authentication_classes =[]