rest-framework框架 -- 认证权限流程源码

认证权限

解析BaseAuthentication源码

#  做认证权限
from rest_framework import exceptions
from ..models import *

class MyAuthentication(object):
    def authenticate(self,request):
        token = request._request.GET.get('token')
        user_token_obj = UserToken.objects.filter(token=token).first()
        if user_token_obj:
            return user_token_obj.user,token
        else:
            raise exceptions.AuthenticationFailed("TOKEN验证失败")

    def authenticate_header(self,request):
        pass

# 上面需要写
#     def authenticate_header(self,request):  #  验证失败的
#         pass
#  BaseAuthentication源码

from rest_framework.authentication import BaseAuthentication
from rest_framework import exceptions
from ..models import *

class MyAuthentication(BaseAuthentication):
    def authenticate(self,request):
        token = request._request.GET.get('token')
        user_token_obj = UserToken.objects.filter(token=token).first()
        if user_token_obj:
            return user_token_obj.user,token
        else:
            raise exceptions.AuthenticationFailed("TOKEN验证失败")

源码帮你搞定了- -
class BaseAuthentication(object):
    """
    All authentication classes should extend BaseAuthentication.
    """

    def authenticate(self, request):
        """
        Authenticate the request and return a two-tuple of (user, token).
        """
        raise NotImplementedError(".authenticate() must be overridden.")

    def authenticate_header(self, request):
        """
        Return a string to be used as the value of the `WWW-Authenticate`
        header in a `401 Unauthenticated` response, or `None` if the
        authentication scheme should return `403 Permission Denied` responses.
        """
        pass

关于认证权限源码解剖

1:从上篇文章可看出这里的类只要继承了APIView 都会执行到dispatch方法，要记住执行到dispatch方法，这里的dispatch是APIvie的里面的

执行dispatch方法时，先走self.initialize方法

    def initialize_request(self, request, *args, **kwargs):
        """
        Returns the initial request object.
        """
        # 把请求弄成一个字典返回
        parser_context = self.get_parser_context(request)

        return Request(
            request,
            parsers=self.get_parsers(),#解析数据，默认的有三种方式，
　　　　　　　#self.get_authenticator优先找自己的，没有就找父类的
            authenticators=self.get_authenticators(),  # 实例化用户认证的对象，封装到request对象中去
            negotiator=self.get_content_negotiator(),
            parser_context=parser_context
        )

2：获取认证相关的类的具体   authenticators=self.get_authenticators(),

    def get_authenticators(self):
        """
        Instantiates and returns the list of authenticators that this view can use.
        """
        # 实例化auth
        return [auth() for auth in self.authentication_classes]  # 返回的是列表[MyAuthentication()]

3：跑到查看认证的类

class APIView(View):
    # The following policies may be set at either globally, or per-view.
    renderer_classes = api_settings.DEFAULT_RENDERER_CLASSES
    parser_classes = api_settings.DEFAULT_PARSER_CLASSES
    authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES    # 默认的验证权限

4：查看默认的验证api_settings（自带默认一般没什么用，pass）

api_settings = APISettings(None, DEFAULTS, IMPORT_STRINGS)
由 DEFAULTS进
DEFAULTS = {
    'DEFAULT_AUTHENTICATION_CLASSES': (   # 默认认证权限
        'rest_framework.authentication.SessionAuthentication',
        'rest_framework.authentication.BasicAuthentication'
    ),
}

5:问题：认证完返回什么内容?  继续源码解析

from rest_framework.authentication import BaseAuthentication
从authentication进去
查看到之前它默认的类了(利用这个就知道我们定制需要返回什么内容)
class BaseAuthentication(object):
    """
    All authentication classes should extend BaseAuthentication.
    """

    def authenticate(self, request):
        """
        Authenticate the request and return a two-tuple of (user, token).
        """
        raise NotImplementedError(".authenticate() must be overridden.")

    def authenticate_header(self, request):
        """
        Return a string to be used as the value of the `WWW-Authenticate`
        header in a `401 Unauthenticated` response, or `None` if the
        authentication scheme should return `403 Permission Denied` responses.
        """
        pass

具体处理认证，从headers里面能获取用户名和密码

class BasicAuthentication(BaseAuthentication):
    """
    HTTP Basic authentication against username/password.
    """
    www_authenticate_realm = 'api'

    def authenticate(self, request):
        """
        Returns a `User` if a correct username and password have been supplied
        using HTTP Basic authentication.  Otherwise returns `None`.
        """
        auth = get_authorization_header(request).split()

        if not auth or auth[0].lower() != b'basic':
            return None   #返回none不处理。让下一个处理

        if len(auth) == 1:
            msg = _('Invalid basic header. No credentials provided.')
            raise exceptions.AuthenticationFailed(msg)
        elif len(auth) > 2:
            msg = _('Invalid basic header. Credentials string should not contain spaces.')
            raise exceptions.AuthenticationFailed(msg)

        try:
            auth_parts = base64.b64decode(auth[1]).decode(HTTP_HEADER_ENCODING).partition(':')
        except (TypeError, UnicodeDecodeError, binascii.Error):
            msg = _('Invalid basic header. Credentials not correctly base64 encoded.')
            raise exceptions.AuthenticationFailed(msg)

        userid, password = auth_parts[0], auth_parts[2]   # 返回用户和密码
        return self.authenticate_credentials(userid, password, request)

    def authenticate_credentials(self, userid, password, request=None):
        """
        Authenticate the userid and password against username and password
        with optional request for context.
        """
        credentials = {
            get_user_model().USERNAME_FIELD: userid,
            'password': password
        }
        user = authenticate(request=request, **credentials)

        if user is None:
            raise exceptions.AuthenticationFailed(_('Invalid username/password.'))

        if not user.is_active:
            raise exceptions.AuthenticationFailed(_('User inactive or deleted.'))

        return (user, None)

    def authenticate_header(self, request):
        return 'Basic realm="%s"' % self.www_authenticate_realm

认证权限的具体步骤

1：直接调到执行dispatch方法，到初始化initial

    def initial(self, request, *args, **kwargs):
        """
        Runs anything that needs to occur prior to calling the method handler.
        """
        self.format_kwarg = self.get_format_suffix(**kwargs)

        # Perform content negotiation and store the accepted info on the request
        neg = self.perform_content_negotiation(request)
        request.accepted_renderer, request.accepted_media_type = neg

        # Determine the API version, if versioning is in use.
        version, scheme = self.determine_version(request, *args, **kwargs)
        request.version, request.versioning_scheme = version, scheme

        # Ensure that the incoming request is permitted
        # 认证
        self.perform_authentication(request)
        # 权限
        self.check_permissions(request)
        # 频率
        self.check_throttles(request)

2：self.perform_authentication(request)

    def perform_authentication(self, request):

        request.user   #  封装    后的request对象将会执行user方法

3：执行request user方法APIview里面的Rquest找到user方法

 @property
    def user(self):
        """
        Returns the user associated with the current request, as authenticated
        by the authentication classes provided to the request.
        """
        if not hasattr(self, '_user'):  # 反射 看request对象是否有’_user'
            with wrap_attributeerrors():
                self._authenticate()
        return self._user   # 返回user

4：执行self._authenticate() 开始用户认证，如果验证成功后返回元组： (用户,用户Token)

def _authenticate(self):
        """
        Attempt to authenticate the request using each authentication instance
        in turn.
        """
        #循环对象列表
        for authenticator in self.authenticators:
            try:
                #执行每一个对象的authenticate 方法
                user_auth_tuple = authenticator.authenticate(self)
            except exceptions.APIException:
                self._not_authenticated()
                raise

            if user_auth_tuple is not None:
                self._authenticator = authenticator
                self.user, self.auth = user_auth_tuple  #返回一个元组，user，和auth，赋给了self,
                # 只要实例化Request，就会有一个request对象，就可以request.user,request.auth了
                return

        self._not_authenticated()

5：在user_auth_tuple = authenticator.authenticate(self) 进行验证，如果验证成功，执行类里的authenticatie方法

6：如果用户没有认证成功：self._not_authenticated()

def _not_authenticated(self):
        """
        Set authenticator, user & authtoken representing an unauthenticated request.

        Defaults are None, AnonymousUser & None.
        """
        #如果跳过了所有认证，默认用户和Token和使用配置文件进行设置
        self._authenticator = None  #

        if api_settings.UNAUTHENTICATED_USER:
            self.user = api_settings.UNAUTHENTICATED_USER() # 默认值为：匿名用户AnonymousUser
        else:
            self.user = None  # None 表示跳过该认证

        if api_settings.UNAUTHENTICATED_TOKEN:
            self.auth = api_settings.UNAUTHENTICATED_TOKEN()  # 默认值为：None
        else:
            self.auth = None

    # (user, token)
    # 表示验证通过并设置用户名和Token；
    # AuthenticationFailed异常

1：    url(r"books/$",views.BookView.as_view(),name="book_list"),
            as_view()
2：    @classmethod
    def as_view(cls, **initkwargs):
        """
        Store the original class on the view function.

        This allows us to discover information about the view when we do URL
        reverse lookups.  Used for breadcrumb generation.
        """
        if isinstance(getattr(cls, 'queryset', None), models.query.QuerySet):
            def force_evaluation():
                raise RuntimeError(
                    'Do not evaluate the `.queryset` attribute directly, '
                    'as the result will be cached and reused between requests. '
                    'Use `.all()` or call `.get_queryset()` instead.'
                )
            cls.queryset._fetch_all = force_evaluation

        view = super(APIView, cls).as_view(**initkwargs)
        view.cls = cls
        view.initkwargs = initkwargs

        # Note: session based authentication is explicitly CSRF validated,
        # all other authentication is CSRF exempt.
        return csrf_exempt(view)

3：        return csrf_exempt(view)
        url(r"books/$",view),
        调用view

4：         view = super(APIView, cls).as_view(**initkwargs)
        找aipview的as_view

5：        def view(request, *args, **kwargs):
            self = cls(**initkwargs)
            if hasattr(self, 'get') and not hasattr(self, 'head'):
                self.head = self.get
            self.request = request
            self.args = args
            self.kwargs = kwargs
            return self.dispatch(request, *args, **kwargs)
6：调dispatch
                这里的dispatch是APIvie的

7：走dispatch的 self.initial(request, *args, **kwargs) 初始化

8：        走认证
                # 认证
        self.perform_authentication(request)

9：  进 认证perform_authentication

10：def perform_authentication(self, request):
        """
        Perform authentication on the incoming request.

        Note that if you override this and simply 'pass', then authentication
        will instead be performed lazily, the first time either
        `request.user` or `request.auth` is accessed.
        """
        request.user   #  封装后的request对象将会执行user方法
        user为静态方法

        要从request里面调用user.

11：    return Request(
            request,
            parsers=self.get_parsers(),
            authenticators=self.get_authenticators(),  # 实例化用户认证的对象，封装到request对象中去
            negotiator=self.get_content_negotiator(),
            parser_context=parser_context
        )

        11.1
          authenticators=self.get_authenticators(),  # 实例化用户认证的对象，封装到requ

        11.2
        def get_authenticators(self):
            """
            Instantiates and returns the list of authenticators that this view can use.
            """
            return [auth() for auth in self.authentication_classes]
        取出auth  然后auth()  实例化 ，---》 [MyAuthentication()]
        调用自定义的验证

12
        Request进去
@property
    def user(self):
        """
        Returns the user associated with the current request, as authenticated
        by the authentication classes provided to the request.
        """
        if not hasattr(self, '_user'):  # 反射 看request对象是否有’_user'
            with wrap_attributeerrors():
                self._authenticate()
        return self._user

13  @property
    def user(self):
        """
        Returns the user associated with the current request, as authenticated
        by the authentication classes provided to the request.
        """
        if not hasattr(self, '_user'):  # 反射 看request对象是否有’_user'
            with wrap_attributeerrors():
                self._authenticate()
        return self._user    

14    self._authenticate()

        def _authenticate(self):
        """
        Attempt to authenticate the request using each authentication instance
        in turn.
        """
        这里self --- 》 request
        for authenticator in self.authenticators:  #  执行[auth() for auth in self.authentication_classes]
            try:
                user_auth_tuple = authenticator.authenticate(self)
            except exceptions.APIException:
                self._not_authenticated()
                raise

            if user_auth_tuple is not None:
                self._authenticator = authenticator
                self.user, self.auth = user_auth_tuple
                return

        self._not_authenticated()
        上面的request 返回了用户名，及信息

15    self.authenticators:    

找到默认权限源码
0
    def initial(self, request, *args, **kwargs):
        """
        Runs anything that needs to occur prior to calling the method handler.
        """
        self.format_kwarg = self.get_format_suffix(**kwargs)

        # Perform content negotiation and store the accepted info on the request
        neg = self.perform_content_negotiation(request)
        request.accepted_renderer, request.accepted_media_type = neg

        # Determine the API version, if versioning is in use.
        version, scheme = self.determine_version(request, *args, **kwargs)
        request.version, request.versioning_scheme = version, scheme

        # Ensure that the incoming request is permitted
        # 认证
        self.perform_authentication(request)
1：调用request user  找到request下的user方法
    def perform_authentication(self, request):
        """
        Perform authentication on the incoming request.

        Note that if you override this and simply 'pass', then authentication
        will instead be performed lazily, the first time either
        `request.user` or `request.auth` is accessed.
        """
        request.user   #  封装    后的request对象将会执行user方法
2：进user
      @property
    def user(self):
        """
        Returns the user associated with the current request, as authenticated
        by the authentication classes provided to the request.
        """
        if not hasattr(self, '_user'):  # 反射 看request对象是否有’_user'
            with wrap_attributeerrors():
                self._authenticate()    # 执行_authenticate()
        return self._user
2.1  self._authenticate()
    def _authenticate(self):
        """
        Attempt to authenticate the request using each authentication instance
        in turn.
        """
        for authenticator in self.authenticators:  #  执行[auth() for auth in self.authentication_classes]  authenticators 这个变量决定我们调用哪些authenticators方法
            try:
                user_auth_tuple = authenticator.authenticate(self)
            except exceptions.APIException:
                self._not_authenticated()
                raise

            if user_auth_tuple is not None:
                self._authenticator = authenticator
                self.user, self.auth = user_auth_tuple
                return

        self._not_authenticated()

到这里是从request类找过来
2.2
class Request(object):
    def __init__(self, request, parsers=None, authenticators=None,
                 negotiator=None, parser_context=None):
        assert isinstance(request, HttpRequest), (
            'The `request` argument must be an instance of '
            '`django.http.HttpRequest`, not `{}.{}`.'
            .format(request.__class__.__module__, request.__class__.__name__)
        )

        self._request = request
        self.parsers = parsers or ()
        self.authenticators = authenticators or ()
authenticators 在init初始化有赋值
接着看哪里给他赋值
2.3
class APIView(View):
    def initialize_request(self, request, *args, **kwargs):
        """
        Returns the initial request object.
        """
        # 把请求弄成一个字典返回
        parser_context = self.get_parser_context(request)

        return Request(
            request,
            parsers=self.get_parsers(),
            authenticators=self.get_authenticators(),  # 实例化用户认证的对象，封装到request对象中去
            negotiator=self.get_content_negotiator(),
            parser_context=parser_context
        )
authenticators=self.get_authenticators(),在这里赋值
3：
    def get_authenticators(self):
        """
        Instantiates and returns the list of authenticators that this view can use.
        """
        # 实例auth  找我们是否定义了authentication_classes没有往上找
        return [auth() for auth in self.authentication_classes]  # [MyAuthentication()]

4：self.authentication_classes
class APIView(View):

    # The following policies may be set at either globally, or per-view.
    renderer_classes = api_settings.DEFAULT_RENDERER_CLASSES
    parser_classes = api_settings.DEFAULT_PARSER_CLASSES
    authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES    # 默认的验证权限

5：
 authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES 

 6：api_settings
self.user = api_settings.UNAUTHENTICATED_USER()

api_settings = APISettings(None, DEFAULTS, IMPORT_STRINGS)

6：里面默认的2个方法
DEFAULTS

默认的全局
def reload_api_settings(*args, **kwargs):
    setting = kwargs['setting']
    if setting == 'REST_FRAMEWORK':
        api_settings.reload()