一.前提

首先是這個代碼基于前后端分離的API,我們用了django的framework模塊,幫助我們快速的編寫restful規(guī)則的接口

前端token原理:

把(token=加密后的字符串,key=name)在登入后發(fā)到客戶端,以后客戶端再發(fā)請求,會攜帶過來服務(wù)端截取(token=加密后的字符串,key=name),我們再利用解密方法,將token和key進行解碼,然后進行比對,成功就是登入過的認證,失敗就是沒有登入過的

還有一種方式,把{name:maple,id:1} 用我自己知道的加密方式加密之后變成了:加密字符串,加密字符串|{name:maple,id:1} 當(dāng)做token,發(fā)到客戶端,以后客戶端再發(fā)請求,會攜帶,加密字符串|{name:maple,id:1}過來,服務(wù)端截取{name:maple,id:1},再用我們的加密方式加密:加密字符串,拿到加密后的字符串進行比對,這種方式,只要寫一個密碼函數(shù)就可以了,無需寫解密函數(shù)

二.token加密與解密

在django的app中定義個token模塊

將有關(guān)token的函數(shù)都放在里面,后面要用到,都調(diào)用這個模塊

加密token函數(shù):

import time import base64 import hmacdef get_token(key, expire=3600):''':param key: str (用戶給定的key，需要用戶保存以便之后驗證token,每次產(chǎn)生token時的key 都可以是同一個key):param expire: int(最大有效時間，單位為s):return: token'''ts_str = str(time.time() + expire)ts_byte = ts_str.encode("utf-8")sha1_tshexstr = hmac.new(key.encode("utf-8"),ts_byte,'sha1').hexdigest()token = ts_str+':'+sha1_tshexstrb64_token = base64.urlsafe_b64encode(token.encode("utf-8"))return b64_token.decode("utf-8")

解密函數(shù):

def out_token(key, token):''':param key: 服務(wù)器給的固定key:param token: 前端傳過來的token:return: true,false'''# token是前端傳過來的token字符串try:token_str = base64.urlsafe_b64decode(token).decode('utf-8')token_list = token_str.split(':')if len(token_list) != 2:return Falsets_str = token_list[0]if float(ts_str) < time.time():# token expiredreturn Falseknown_sha1_tsstr = token_list[1]sha1 = hmac.new(key.encode("utf-8"),ts_str.encode('utf-8'),'sha1')calc_sha1_tsstr = sha1.hexdigest()if calc_sha1_tsstr != known_sha1_tsstr:# token certification failedreturn False# token certification successreturn Trueexcept Exception as e:print(e)

三、視圖CBV

登入函數(shù):

from rest_framework.response import Response from rest_framework.views import APIView from app01 import models # get_token生成加密token,out_token解密token from app01.token_module import get_token,out_tokenclass AuthLogin(APIView):def post(self,request):response={"status":100,"msg":None}name=request.data.get("name")pwd=request.data.get("pwd")print(name,pwd)user = auth.authenticate(username=name, password=pwd)# user=models.User.objects.filter(username=name,password=pwd).first()if user:# token=get_random(name)# 將name進行加密,3600設(shè)定超時時間token=get_token(name,60)models.UserToken.objects.update_or_create(user=user,defaults={"token":token})response["msg"]="登入成功"response["token"]=tokenresponse["name"]=user.usernameelse:response["msg"]="用戶名或密碼錯誤"return Response(response)

登入后訪問函數(shù):

from rest_framework.views import APIView from app01 import models from app01.serialize_module import BookSerialize from app01.authentication_module import TokenAuth1,TokenAuth2class Books(APIView):authentication_classes = [TokenAuth2]def get(self,request):response = {"status": 100, "msg": None}book_list=models.Book.objects.all()book_ser = BookSerialize(book_list, many=True)response["books"]=book_ser.datareturn Response(response)

路由:

from django.conf.urls import url from django.contrib import admin from app01 import viewsurlpatterns = [url(r'^admin/', admin.site.urls),url(r'^books/$', views.Books.as_view()),url(r'^login/$', views.AuthLogin.as_view()), ]

framework認證功能

from rest_framework.authentication import BaseAuthentication from app01 import models from rest_framework.exceptions import NotAuthenticated # get_token生成加密token,out_token解密token from app01.token_module import get_token,out_token# 存儲在前端的token解密比對 class TokenAuth2(BaseAuthentication):def authenticate(self,request):token=request.GET.get("token")name=request.GET.get("name")token_obj=out_token(name,token)if token_obj:returnelse:raise NotAuthenticated("你沒有登入")

利用postman軟件在前端提交

登入POST請求:

返回結(jié)果:

訪問get請求:

轉(zhuǎn)載于:https://www.cnblogs.com/Paul-watermelon/p/11302449.html

總結(jié)

以上是生活随笔為你收集整理的django基于存储在前端的token用户认证的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。