Flask 学习 七 用户认证

使用werkzeug 实现密码散列

from werkzeug.security import generate_password_hash,check_password_hash

class User(db.Model):
    __tablename__ = 'users'
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(64), unique=True,index=True)
    role_id=db.Column(db.Integer,db.ForeignKey('roles.id'))
    password_hash=db.Column(db.String(128))
    @property
    def password(self):
        raise AttributeError('密码不是一个可读属性') #只写属性
    @password.setter
    def password(self,password):
        self.password_hash = generate_password_hash(password)

    def verify_password(self,password):
        return check_password_hash(self.password_hash,password)

    def __repr__(self):
        return '<User %r>' % self.username

密码散列化测试tests/test_url_model.py

#！/usr/bin/env python
# -*- coding:utf-8 -*-
import unittest
from app.models import User
class UserModelTestCase(unittest.TestCase):
    def test_password_setter(self):
        u = User(password='cat')
        self.assertTrue(u.password_hash is not None)
    def test_no_password_getter(self):
        u = User(password='cat')
        with self.assertRaises(AttributeError):
            u.password
    def test_password_verification(self):
        u = User(password='cat')
        self.assertTrue(u.verify_password('cat'))
        self.assertFalse(u.verify_password('dog'))
    def test_password_salts_are_random(self):
        u =User(password='cat')
        u2=User(password='cat')
        self.assertTrue(u.password_hash != u2.password_hash)

创建用户认证蓝本

app/auth/__init__.py

#！/usr/bin/env python
# -*- coding:utf-8 -*-
from flask import Blueprint
auth = Blueprint('auth',__name__)
from . import views

app/auth/views.py 蓝本路由和视图函数

#！/usr/bin/env python
# -*- coding:utf-8 -*-
from flask import render_template
from . import auth

@auth.route('/login')
def login():
    return render_template('auth/login.html')

app/__init__.py 注册蓝本

from .auth import auth as auth_blueprint
app.register_blueprint(auth_blueprint,url_prefix='/auth')

安装flask-login插件

pip install flask-login

修改User模型，支持用户登陆 app/models.py

from flask_login import UserMixin

class User(UserMixin,db.Model):
    __tablename__ = 'users'
    id = db.Column(db.Integer, primary_key=True)
    email=db.Column(db.String(64),unique=True,index=True)
    username = db.Column(db.String(64), unique=True,index=True)
    role_id=db.Column(db.Integer,db.ForeignKey('roles.id'))
    password_hash=db.Column(db.String(128))

app/__init__.py 初始化Flask_Login

from flask_login import LoginManager
#初始化Flask-Login
login_manager=LoginManager()
login_manager.session_protection='strong' # 记录客户端ip，用户代理信息，发现异动，登出用户,可以设置不同等级None,'basic','strong'
login_manager.login_view='auth.login' # 设置登录页面端点，蓝本的名字也要加到前面

def create_app(config_name):
    #....
    login_manager.init_app(app) #初始化登陆
    #....

app/models.py 加载用户的回掉函数

from . import login_manager

# 加载用户的回调函数
@login_manager.user_loader
def load_user(user_id):
    return User.query.get(int(user_id))
# 加载用户回掉函数，接收以Unicode字符串表示的用户标识符，如果能找到这个用户必须返回用户对象，否则返回None

保护路由

为了只让认证的用户访问，未认证的用户会拦截请求，发往登陆页面

#保护路由
@app.route('/secret')
@login_required
def secret():
    return '只有认证后的用户才能登陆'

添加登陆表单

app/auth/forms.py

from flask_wtf import FlaskForm
from wtforms import StringField,PasswordField,BooleanField,SubmitField
from wtforms.validators import DataRequired,Length,Email

class LoginForm(FlaskForm):
    email=StringField('邮箱',validators=[DataRequired(),Length(1,64),Email()])
    password=PasswordField('密码',validators=[DataRequired()])
    remember_me=BooleanField('保持登陆')
    submit = SubmitField('登陆')

auth/login.html  用wtf.quick_form()渲染表单

{% extends 'base.html' %}
{% import'bootstrap/wtf.html' as wtf %}
{% block title %}Flask-登陆{% endblock %}
{% block page_content %}
    <div class="page-header">
    <h1>登陆</h1>
    </div>
    <div class="col-md-4">
        {{ wtf.quick_form(form) }}
    </div>
{% endblock %}

base.html  # current_user.is_authenticated 如果是匿名用户登陆is_authenticated返回False,这个方法可以判断当前用户是否登陆

<ul class="nav navbar-nav navbar-right">
            {% if current_user.is_authenticated %}
             <li><a href="{{ url_for('auth.logout') }}">退出登陆</a></li>
            {% else %}
            <li><a href="{{ url_for('auth.login') }}">立即登陆</a></li>
            {% endif %}
</ul>

登入用户

app/auth/views.py #登陆路由

from flask import render_template,redirect,request,url_for,flash
from flask_login import login_user,login_required,logout_user,current_user
from . import auth
from ..models import User
from .forms import LoginForm

@auth.route('/login',methods=['get','post'])
def login():
    form = LoginForm()
    if form.validate_on_submit(): # 验证表单数据
        user = User.query.filter_by(email=form.email.data).first()
        if user is not None and user.verify_password(form.password.data): # verify_password会验证表单数据
            login_user(user,form.remember_me.data) # 如果为True则为用户生成长期有效的cookies
            return redirect(request.args.get('next') or url_for('main.index'))# next保存原地址(从request.args字典中读取)
        flash('用户名或密码无效')
    return render_template('auth/login.html',form=form)

更新登陆模板auth/login.html

{% extends 'base.html' %}
{% import'bootstrap/wtf.html' as wtf %}
{% block title %}Flask-登陆{% endblock %}
{% block page_content %}
    <div class="page-header">
    <h1>登陆</h1>
    </div>
    <div class="col-md-4">
        {{ wtf.quick_form(form) }}
    </div>
{% endblock %}

登出用户

auth/views.py

from flask_login import login_user,login_required,logout_user,current_user

@auth.route('/logout')
@login_required
def logout():
    logout_user()
    flash('你已经退出')
    return redirect(url_for('main.index'))

测试登陆 index.html

<h1>Hello,
        {% if current_user.is_authenticated %}
            {{ current_user.username }}
        {% else %}
            访客
        {% endif %}!
</h1>

注册新用户

添加用户注册表单

from flask_wtf import FlaskForm
from wtforms import StringField,PasswordField,BooleanField,SubmitField
from wtforms.validators import DataRequired,Length,Email,Regexp,EqualTo
from ..models import User

class RegistrationForm(FlaskForm):
    email = StringField('邮箱', validators=[DataRequired(), Length(1, 64), Email()])
    username= StringField('用户名', validators=[DataRequired(), Length(1, 64), Regexp('^[A-Za-z][A-Za-z0-9_.]*$',0,'用户名必须是字母，数字，点号，下划线')])
    password = PasswordField('密码', validators=[DataRequired(),EqualTo('password2',message='密码不一致')])
    password2 =  PasswordField('再次输入密码', validators=[DataRequired()])
    submit = SubmitField('注册')
    def validate_email(self,filed):
        if User.query.filter_by(email=filed.data).first():
            raise ValidationError('邮箱已被注册')
    def validate_username(self,filed):
        if User.query.filter_by(username=filed.data).first():
            raise ValidationError('用户名已被使用')

auth/register.html

{% extends 'base.html' %}
{% import'bootstrap/wtf.html' as wtf %}
{% block title %}Flask-注册{% endblock %}
{% block page_content %}
    <div class="page-header">
    <h1>注册</h1>
    </div>
    <div class="col-md-4">
        {{ wtf.quick_form(form) }}
    </div>
{% endblock %}

auth/login.html 添加链接到注册页面

 <p>新用户？<a href="{{ url_for('auth.register') }}">点击这里注册</a></p>

app/auth/views.py

@auth.route('/register',methods=['get','post'])
def register():
    form = RegistrationForm()
    if form.validate_on_submit():
        user=User(email = form.email.data,
                  username=form.username.data,
                  password=form.password.data)
        db.session.add(user)
        flash('你现在已经登陆了')
        return redirect(url_for('auth.login'))
    return render_template('auth/register.html',form=form)

确认账户

使用isdangerous生成确认令牌

app/models.py 确认用户账户

from itsdangerous import TimedJSONWebSignatureSerializer as Serializer
from flask import current_app
from . import db
class User(UserMixin,db.Model):
    # ...
    confirmed = db.Column(db.Boolean,default=False)
    def generate_confirmation_token(self,expiration=3600):  #生成令牌，有效期1小时
        s = Serializer(current_app.config['SECRET_KEY'],expiration)
        return s.dumps({'confirm':self.id})
    def confirm(self,token):  # 检验令牌 如果通过把confirmed字段设为True
        s=Serializer(current_app.config['SECRET_KEY'])
        try:
            data = s.loads(token)
        except:
            return False
        if data.get('confirm') !=self.id: # 检查令牌id是否存储是已登录用户进行匹配
            return False
        self.confirmed=True
        db.session.add(self)
        return True

发送确认邮件

auth/views.py

from ..email import send_mail

@auth.route('/register',methods=['get','post'])
def register():
    form = RegistrationForm()
    if form.validate_on_submit():
        user=User(email = form.email.data,
                  username=form.username.data,
                  password=form.password.data)
        db.session.add(user)
        db.session.commit()
        token = user.generate_confirmation_token()
        send_mail(user.email,'确认你的账户','auth/email/confirm',user=user,token=token)
        flash('我们已经给你发送了一封确认邮件')
        return redirect(url_for('main.index'))
    return render_template('auth/register.html',form=form)

auth/email/cinfirm.txt

亲爱的，{{ user.username }}
欢迎来到 Flasky
为了确认您的账户，请点击以下链接:

{{ url_for('auth.confirm',token=token,_external=True) }} #返回绝对路径

Flasky 团队

auth/views.py

from flask_login import current_user
@auth.route('/confirm/<token>')
@login_required # 保护这个路由，用户需要先登录
def confirm(token):
    if current_user.confirmed:
        return redirect(url_for('main.index'))
    if current_user.confirm(token):
        flash('你已经确认了你的账户，谢谢')
    else:
        flash('确认链接失效或过期')
    return redirect(url_for('main.index'))

app/auth/views.py 使用before_app_request来全局使用处理程序中未确认的用户

@auth.before_app_request # 如果返回响应或重定向，会直接发送至客户端，不会调用请求视图函数
def before_request():
    if current_user.is_authenticated\
            and not current_user.confirmed \
            and request.endpoint[:5] != 'auth.'\   #访问路由获取权限
            and request.endpoint != 'static':
        return redirect(url_for('auth.unconfirmed'))

@auth.route('/unconfirmed')
def unconfirmed():
    if current_user.is_anonymous or current_user.confirmed:
        return redirect(url_for('main.index'))
    return render_template('auth/unconfirmed.html')

auth/views.py 重新发送确认邮件

@auth.route('/confirm')
@login_required
def resend_confirmation():
    token=current_user.generate_confirmation_token()
    send_mail(current_user.email,'确认你的账户','auth/email/confirm',user=current_user,token=token)
    flash('一封新的确认邮件已经发送到您的邮箱')
    return redirect(url_for('main.index'))

管理账户：

修改密码  重设密码 修改电子邮件地址

https://github.com/Erick-LONG/flask_blog/commit/3748e70d9f986b066328185bcf417d8b8205ed8c

https://github.com/Erick-LONG/flask_blog/commit/ce4a67d31f0d7d5f5c6719eebb193b2949c77b0c

https://github.com/Erick-LONG/flask_blog/commit/f89ef3dac3819129165be4d9b2a67a2bb092cf34