Django实现接口token检测的完整实现方案

pip install djangorestframework
pip install djangorestframework.authtoken

INSTALLED_APPS = [    'django.contrib.admin',    'django.contrib.auth',    'django.contrib.contenttypes',    'django.contrib.sessions',    'django.contrib.messages',    'django.contrib.staticfiles',    'rest_framework',    'rest_framework.authtoken',]

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.TokenAuthentication',
    ),
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
    ),
}

python manage.py migrate

from django.contrib.auth import authenticate
from rest_framework.authtoken.models import Token
from rest_framework.response import Response
from rest_framework.views import APIView
from rest_framework import status

class LoginView(APIView):
    def post(self, request):
        username = request.data.get("username")
        password = request.data.get("password")
        user = authenticate(username=username, password=password)
        if user:
            token, created = Token.objects.get_or_create(user=user)
            return Response({"token": token.key})
        return Response({"error": "Invalid Credentials"}, status=status.HTTP_401_UNAUTHORIZED)

from rest_framework.authentication import TokenAuthentication
from rest_framework.permissions import IsAuthenticated
from rest_framework.views import APIView
from rest_framework.response import Response

class ProtectedView(APIView):
    authentication_classes = [TokenAuthentication]
    permission_classes = [IsAuthenticated]

    def get(self, request):
        return Response({"message": "You have access to this protected endpoint."})

curl -X POST http://127.0.0.1:8000/api/login/ -H "Content-Type: application/json" -d '{"username": "admin", "password": "password"}'

{"token": "abc123xyz456"}

curl -X GET http://127.0.0.1:8000/api/protected/ -H "Authorization: Token abc123xyz456"

{"message": "You have access to this protected endpoint."}

from django.db import models
from django.contrib.auth.models import User
import uuid

class CustomToken(models.Model):
    user = models.OneToOneField(User, on_delete=models.CASCADE)
    key = models.CharField(max_length=255, unique=True, default=uuid.uuid4)
    created_at = models.DateTimeField(auto_now_add=True)

    def __str__(self):
        return self.key

from django.contrib.auth import authenticate
from django.http import JsonResponse
from .models import CustomToken

def custom_login(request):
    if request.method == "POST":
        username = request.POST.get("username")
        password = request.POST.get("password")
        user = authenticate(username=username, password=password)

        if user:
            token, created = CustomToken.objects.get_or_create(user=user)
            return JsonResponse({"token": token.key})
        return JsonResponse({"error": "Invalid credentials"}, status=401)

from django.http import JsonResponse
from .models import CustomToken

class TokenMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        token = request.headers.get("Authorization")

        if not token:
            return JsonResponse({"error": "Token missing"}, status=401)

        try:
            user_token = CustomToken.objects.get(key=token)
            request.user = user_token.user
        except CustomToken.DoesNotExist:
            return JsonResponse({"error": "Invalid token"}, status=401)

        return self.get_response(request)

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.middleware.authentication.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    'myapp.middleware.TokenMiddleware',  # 添加自定义 Token 认证中间件
]

from django.http import JsonResponse

def protected_view(request):
    return JsonResponse({"message": "Welcome, you are authenticated!"})

curl -X POST http://127.0.0.1:8000/custom_login/ -d "username=admin&password=admin"

{"token": "abc123xyz456"}

curl -X GET http://127.0.0.1:8000/protected_view/ -H "Authorization: abc123xyz456"

{"message": "Welcome, you are authenticated!"}