编写登录功能引出认证，权限，频率：
前端通过接口测试工具Postman将用户名和密码通过HTTP请求发送至Django框架
models.py
from django.db import models
# Create your models here.
class Books(models.Model):
name = models.CharField(max_length=32)
price = models.IntegerField()
publish = models.ForeignKey(to='Publish', on_delete=models.DO_NOTHING)
class Publish(models.Model):
name = models.CharField(max_length=32)
addr = models.CharField(max_length=32)
class User(models.Model):
username = models.CharField(max_length=32)
password = models.CharField(max_length=32)
"""
用户登录生成随机字符串，响应中携带字符串，发送至服务端后，服务端做逻辑判断。
一般一对一为垂直分表。数据库优化的手段
"""
class UserToken(models.Model):
user = models.OneToOneField(to='User', on_delete=models.CASCADE)
token = models.CharField(max_length=64)
模型层拓展:
字段参数可以填写函数名，但不是不能加括号。
views.py
from rest_framework.views import APIView
from . import models
import uuid
from rest_framework.response import Response
class UserAPIView(APIView):
def post(self,request,*args,**kwargs):
back_dic = {'code':200,'msg':''}
username = request.data.get('username')
password = request.data.get('password')
# 过滤出user表中含有请求中携带的数据，username,password.
user = models.User.objects.filter(username=username,password=password).first()
print(user)
if user:
"""
有用户的情况下
登录成功之后生成token
user=user,根据user查询，查询不到使用defaults新增，查询到更新。
"""
# 生成随机字符串,请求中携带随机字符传
token = str(uuid.uuid4())
models.UserToken.objects.update_or_create(defaults={'token': token}, user=user)
back_dic['msg'] = '随机字符串更新'
back_dic['token'] = token
else:
back_dic['code'] = 201
back_dic['msg'] = '用户名或者密码错误'
return Response(back_dic)
此时客户端发送post请求，后端验证正确会产生一条新的token覆盖原有的token。
认证，权限，频率所在位置。
APIView --> dispath(重写了request方法) --> initial(认证，权限，频率)
def initial(self, request, *args, **kwargs):
"""
Runs anything that needs to occur prior to calling the method handler.
"""
self.format_kwarg = self.get_format_suffix(**kwargs)
# Perform content negotiation and store the accepted info on the request
neg = self.perform_content_negotiation(request)
request.accepted_renderer, request.accepted_media_type = neg
# Determine the API version, if versioning is in use.
version, scheme = self.determine_version(request, *args, **kwargs)
request.version, request.versioning_scheme = version, scheme
# Ensure that the incoming request is permitted
"""认证"""
self.perform_authentication(request)
"""权限"""
self.check_permissions(request)
"""频率"""
self.check_throttles(request)
认证类的编写
之前提到过，如果代码不属于视图层就另开一个py文件。
认证：只有携带token随机字符串才可以访问某个路由。
urls.py
from app01 import views
from rest_framework.routers import SimpleRouter, DefaultRouter
from django.urls import path, include
router = SimpleRouter()
router.register('books', views.BookAPIView)
urlpatterns = [
# path('books/',views.BookAPIView.as_view({'get':'login'})),
path('', include(router.urls)),
path('login/', views.UserAPIView.as_view())
]
views.py
from .auth import LoginAuth
from rest_framework.generics import ListAPIView
from rest_framework.viewsets import ViewSetMixin
class BookAPIView(ViewSetMixin, ListAPIView):
queryset = Books.objects.all()
serializer_class = BookSerializers
# 增加登录认证
authentication_classes = [LoginAuth]
auth.py
"""认证类"""
from rest_framework.authentication import BaseAuthentication
from . import models
from rest_framework.exceptions import AuthenticationFailed
class LoginAuth(BaseAuthentication):
def authenticate(self,request):
# 写认证规则
# 取出用户携带的token
# -注意：取get提交的数据，不要从request.GET中取，从request.query_params中取
token = request.query_params.get('token')
print(token)
# 去数据库查询，token是否存在，存在表示登录了，不存在表示为登录
user_token = models.UserToken.objects.filter(token=token).first()
if user_token:
# 943ffc46-3826-47f9-a4de-ea9cd4bd23d6
print(user_token.token)
# User object (1)，模型类对象
print(user_token.user)
# junjie
print(user_token.user.username)
return user_token.user,user_token.token
raise AuthenticationFailed('您没有登录，认证失败')
此时想要访问books必须携带token才可以访问。
认证类的全局和局部使用
全局配置：
REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES':[
'app01.auth.LoginAuth'
]
}
局部禁用配置：
class UserAPIView(APIView):
authentication_classes = []
源码分析：
# APIView--->dispathch方法的-----》self.initial(request, *args, **kwargs)（497行）---》APIView的initial方法----》有三句话
self.perform_authentication(request) # 认证
self.check_permissions(request) # 权限
self.check_throttles(request) # 频率
# self.perform_authentication(request)----》新的request对象的.user(是个方法，包装成了数据数属性)---》新的Request类中找到了user方法---》self._authenticate()-----》Request类中的_authenticate
def _authenticate(self):
for authenticator in self.authenticators: # 配置在视图类中认证类列表，实例化得到的对象
try:
user_auth_tuple = authenticator.authenticate(self)
except exceptions.APIException:
self._not_authenticated()
raise
if user_auth_tuple is not None:
self._authenticator = authenticator
self.user, self.auth = user_auth_tuple
return
# self.authenticators，self是Request类的对象，authenticators属性是Request这个类在实例化的时候，传入的
# Request类在实例化的时候代码
return Request(
request,
parsers=self.get_parsers(),
authenticators=self.get_authenticators(), # 要看的
negotiator=self.get_content_negotiator(),
parser_context=parser_context
)
# self.get_authenticators()是APIView的方法
def get_authenticators(self):
# 列表推导式
return [auth() for auth in self.authentication_classes]
# 返回结果是我们配在视图类中自己写的认证类列表的对象
return [LoginAuth(),]
权限组件
导入模块
from rest_framework.permissions import BasePermission
auth.py
from rest_framework.permissions import BasePermission
class UserPermission(BasePermission):
def has_permission(self, request, view):
"""
认证类走完再走权限类，所以request.user可以拿到当前登录用户
"""
if request.user.user_type == 1:
return True
return False
全局配置使用:
REST_FRAMEWORK = {
'DEFAULT_PERMISSION_CLASSES': [
'app01.auth.UserPermission',
],
}
局部使用:
class BookAPIView(ViewSetMixin, ListAPIView):
queryset = Books.objects.all()
serializer_class = BookSerializers
# 增加登录认证
authentication_classes = [LoginAuth]
# 增加权限类
permission_classes = [UserPermission]
```python
#### 局部禁用:
```python
permission_classes = []
权限类源码解读
APIView --> dispath --> initial --> self.check_permissions(request) --》
def check_permissions(self, request):
"""
for permission in self.get_permissions(),self.get_permissions()在哪？
通过源码可以看到是权限类的全局和局部配置。局部有优先局部，局部没有定义取全局，全局没有去内置。
def get_permissions(self):
return [permission() for permission in self.permission_classes]
"""
for permission in self.get_permissions():
"""
对应到auth.py中的权限类，如果为True，代码正常执行，如果为False，执行self.permission_denied
"""
if not permission.has_permission(request, self):
self.permission_denied(
request,
"""
反射，现在auth.py中的权限类找massage.
"""
message=getattr(permission, 'message', None),
code=getattr(permission, 'code', None)
)
# message 自定义报错信息
def permission_denied(self, request, message=None, code=None):
"""
If request is not permitted, determine what kind of exception to raise.
"""
if request.authenticators and not request.successful_authenticator:
raise exceptions.NotAuthenticated()
raise exceptions.PermissionDenied(detail=message, code=code)
auth.py
class UserPermission(BasePermission):
def has_permission(self, request, view):
"""
认证类走完再走权限类，所以request.user可以拿到当前登录用户
"""
if request.user.user_type == 1:
return True
return False
频率组件的使用
频率的作用: 可以对接口访问的频次进行限制，以减轻服务器压力。一般用于付费购买次数,投票等场景使用.
**导入模块: **
from rest_framework.throttling import SimpleRateThrottle
auth.py，写一个类，继承基类，重写get_cache_key方法
class MyThrottle(SimpleRateThrottle):
# scope一定要写，字符串对应到settings.py中配置REST_FRAMEWORK。
scope = 'ip_Throttle'
def get_cache_key(self, request, view):
# 请求头所包含的信息在META中
# 127.0.0.1
print(request.META.get('REMOTE_ADDR'))
return request.META.get('REMOTE_ADDR')
#### settings.py，配置文件中一定要配置。
REST_FRAMEWORK = {
# （一分钟访问三次），key要跟类中的scope对应
'DEFAULT_THROTTLE_RATES':{
'ip_Throttle':'3/m'
}
}
settings.py ，全局配置。
REST_FRAMEWORK = {
# （一分钟访问三次），key要跟类中的scope对应
'DEFAULT_THROTTLE_RATES':{
'ip_Throttle':'3/m'
},
# 全局配置
'DEFAULT_THROTTLE_CLASSES': (
'app01.auth.MyThrottle',
),
}
views.py，视图类中配置
class BookAPIView(ViewSetMixin, ListAPIView):
# 局部使用
throttle_classes = [MyThrottle,]
