Django JWT

JWT

""" 1) jwt = base64(头部).base(载荷).hash256(base64(头部).base(载荷).密钥) 2) base64是可逆的算法、hash256是不可逆的算法 3) 密钥是固定的字符串，保存在服务器 """

drf-jwt

http://getblimp.github.io/django-rest-framework-jwt/

pip install djangorestframework-jwt

from django.urls import path from rest_framework_jwt.views import obtain_jwt_token urlpatterns = [     path('login/', obtain_jwt_token), ]

""" postman发生post请求  接口：http://api.luffy.cn:8000/user/login/  数据： {     "username":"admin",     "password":"admin" } """

import datetime JWT_AUTH = {     # 过期时间     'JWT_EXPIRATION_DELTA': datetime.timedelta(days=1),     # 自定义认证结果：见下方序列化user和自定义response     'JWT_RESPONSE_PAYLOAD_HANDLER': 'user.utils.jwt_response_payload_handler',   }

from rest_framework import serializers from . import models class UserModelSerializers(serializers.ModelSerializer):     class Meta:         model = models.User         fields = ['username']

from .serializers import UserModelSerializers def jwt_response_payload_handler(token, user=None, request=None):     return {         'status': 0,         'msg': 'ok',         'data': {             'token': token,             'user': UserModelSerializers(user).data         }     }

import jwt from rest_framework.exceptions import AuthenticationFailed from rest_framework_jwt.authentication import jwt_decode_handler from rest_framework_jwt.authentication import get_authorization_header from rest_framework_jwt.authentication import BaseJSONWebTokenAuthentication  class JSONWebTokenAuthentication(BaseJSONWebTokenAuthentication):     def authenticate(self, request):         jwt_value = get_authorization_header(request)          if not jwt_value:             raise AuthenticationFailed('Authorization 字段是必须的')         try:             payload = jwt_decode_handler(jwt_value)         except jwt.ExpiredSignature:             raise AuthenticationFailed('签名过期')         except jwt.InvalidTokenError:             raise AuthenticationFailed('非法用户')         user = self.authenticate_credentials(payload)          return user, jwt_value

REST_FRAMEWORK = {     # 认证模块     'DEFAULT_AUTHENTICATION_CLASSES': (         'user.authentications.JSONWebTokenAuthentication',     ), }

# 局部禁用 authentication_classes = []  # 局部启用 from user.authentications import JSONWebTokenAuthentication authentication_classes = [JSONWebTokenAuthentication]

import re from .models import User from django.contrib.auth.backends import ModelBackend class JWTModelBackend(ModelBackend):     def authenticate(self, request, username=None, password=None, **kwargs):         try:             if re.match(r'^1[3-9]\d{9}$', username):                 user = User.objects.get(mobile=username)             else:                 user = User.objects.get(username=username)         except User.DoesNotExist:             return None         if user.check_password(password) and self.user_can_authenticate(user):             return user

AUTHENTICATION_BACKENDS = ['user.utils.JWTModelBackend']

from rest_framework_jwt.settings import api_settings  jwt_payload_handler = api_settings.JWT_PAYLOAD_HANDLER jwt_encode_handler = api_settings.JWT_ENCODE_HANDLER  payload = jwt_payload_handler(user) token = jwt_encode_handler(payload)

来源：博客园

作者：F丶繁星

链接：https://www.cnblogs.com/bladecheng/p/11545071.html