JWT认证

JWT简介

JWT全称为Json Web Token, 是由三部分进行组成:

• base64(头部).base(载荷).hash256(base64(头部).base(载荷).密钥)
  • base64是可逆算法, 而hash256是不可逆算法
  • 密钥是存储在服务器的固定字符串

安装

pip install djangorestframework-jwt

djang-jwt开发

配置

# settings.py

import datetime

JWT_AUTH = {
    # 过期时间
    'JWT_EXPIRATION_DELTA': datetime.timedelta(days=1),
}

手动签发jwt token

from rest_framework_jwt.settings import api_settings

jwt_payload_handler = api_settings.JWT_PAYLOAD_HANDLER
jwt_encode_handler = api_settings.JWT_ENCODE_HANDLER

payload = jwt_payload_handler(user)
token = jwt_encode_handler(payload)

基于django_restframework-jwt的全局认证

import jwt
from rest_framework.exceptions import AuthenticationFailed
from rest_framework_jwt import authentication

class JSONWebTokenAuthentication(authentication.BaseJSONWebTokenAuthentication):
    def authenticate(self, request):
        jwt_value = authentication.get_authorization_header(request)

        if not jwt_value:
            raise AuthenticationFailed('Authorization 字段是必须的')
        try:
            payload = authentication.jwt_decode_handler(jwt_value)
        except jwt.ExpiredSignature:
            raise AuthenticationFailed('签名过期')
        except jwt.InvalidTokenError:
            raise AuthenticationFailed('非法用户')
        user = self.authenticate_credentials(payload)

        return user, jwt_value

全局启用

# settings.py

REST_FRAMEWORK = {
    # 认证模块
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'user.authentications.JSONWebTokenAuthentication',
    ),
}

局部启用禁用：任何一个cbv类首行

# 局部禁用
authentication_classes = []

# 局部启用
from user.authentications import JSONWebTokenAuthentication
authentication_classes = [JSONWebTokenAuthentication]