{
 'typ': 'JWT',
 'alg': 'HS256'
}

{
 "sub": "1234567890",
 "name": "John Doe",
 "admin": true
}

REST_FRAMEWORK = {
 'DEFAULT_AUTHENTICATION_CLASSES': (
  'rest_framework_jwt.authentication.JSONWebTokenAuthentication',
  'rest_framework.authentication.SessionAuthentication',
  'rest_framework.authentication.BasicAuthentication',
 ),
}

JWT_AUTH = {
 'JWT_EXPIRATION_DELTA': datetime.timedelta(days=1),
}

from rest_framework_jwt.settings import api_settings

jwt_payload_handler = api_settings.JWT_PAYLOAD_HANDLER
jwt_encode_handler = api_settings.JWT_ENCODE_HANDLER

payload = jwt_payload_handler(user)
token = jwt_encode_handler(payload)

from rest_framework_jwt.views import obtain_jwt_token

urlpatterns = [
 url(r'^authorizations/$', obtain_jwt_token),
]

class ObtainJSONWebToken(JSONWebTokenAPIView):
 """
 API View that receives a POST with a user's username and password.

 Returns a JSON Web Token that can be used for authenticated requests.
 """
 serializer_class = JSONWebTokenSerializer

def post(self, request, *args, **kwargs):
  serializer = self.get_serializer(data=request.data)

  if serializer.is_valid():
   user = serializer.object.get('user') or request.user
   token = serializer.object.get('token')
   response_data = jwt_response_payload_handler(token, user, request)
   response = Response(response_data)
   if api_settings.JWT_AUTH_COOKIE:
    expiration = (datetime.utcnow() +
        api_settings.JWT_EXPIRATION_DELTA)
    response.set_cookie(api_settings.JWT_AUTH_COOKIE,
         token,
         expires=expiration,
         httponly=True)
   return response

  return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

def dispatch(self, request, *args, **kwargs):
  """
  `.dispatch()` is pretty much the same as Django's regular dispatch,
  but with extra hooks for startup, finalize, and exception handling.
  """
  self.args = args
  self.kwargs = kwargs
  request = self.initialize_request(request, *args, **kwargs)
  self.request = request
  self.headers = self.default_response_headers # deprecate"htmlcode">

def initialize_request(self, request, *args, **kwargs):
  """
  Returns the initial request object.
  """
  parser_context = self.get_parser_context(request)

  return Request(
   request,
   parsers=self.get_parsers(),
   authenticators=self.get_authenticators(),
   negotiator=self.get_content_negotiator(),
   parser_context=parser_context
  )




我们需要关注的只有 authenticators=self.get_authenticators()这一句,


def get_authenticators(self):
  """
  Instantiates and returns the list of authenticators that this view can use.
  """
  return [auth() for auth in self.authentication_classes]



接着往上照，可以看到类属性 permission_classes = api_settings.DEFAULT_PERMISSION_CLASSES，这就是要什么我们要在django配置中加入DEFAULT_PERMISSION_CLASSES配置，上述方法会遍历我们在配置中写到的列表，拿到里面的验证类，并进行实例化，并将生成的对象装在一个新的列表中，保存在新生成的Request对象中。然后我们接着看dispatch方法，在实际调用视图类中的对应方法前，还调用了self.initial()方法进行一些初始化操作。


def initial(self, request, *args, **kwargs):
  """
  Runs anything that needs to occur prior to calling the method handler.
  """
  self.format_kwarg = self.get_format_suffix(**kwargs)

  # Perform content negotiation and store the accepted info on the request
  neg = self.perform_content_negotiation(request)
  request.accepted_renderer, request.accepted_media_type = neg

  # Determine the API version, if versioning is in use.
  version, scheme = self.determine_version(request, *args, **kwargs)
  request.version, request.versioning_scheme = version, scheme

  # Ensure that the incoming request is permitted
  self.perform_authentication(request)
  self.check_permissions(request)
  self.check_throttles(request)




我们需要关注的是最后三排，分别调用了三个方法，进行身份验证，权限验证和分流操作，这里我们只关注 身份验证方法，self.perform_authentication()，该方法内只有一句代码request.user，看起来像是在调用request对象的user属性，其实不然，我们可以到DRF框架的Request对象中找到以下方法。


@property
 def user(self):
  """
  Returns the user associated with the current request, as authenticated
  by the authentication classes provided to the request.
  """
  if not hasattr(self, '_user'):
   with wrap_attributeerrors():
    self._authenticate()
  return self._user



user方法经过property装饰器装饰后，就可以像一个属性一样调用该方法，该方法在Request对象中存在对应的user时会直接返回，若用户登陆时，Request对象中没有对应的user，所以代码会走if判断里面，我们只需要关注方法self._authenticate()的调用即可。


def _authenticate(self):
  """
  Attempt to authenticate the request using each authentication instance
  in turn.
  """
  for authenticator in self.authenticators:
   try:
    user_auth_tuple = authenticator.authenticate(self)
   except exceptions.APIException:
    self._not_authenticated()
    raise

   if user_auth_tuple is not None:
    self._authenticator = authenticator
    self.user, self.auth = user_auth_tuple
    return

  self._not_authenticated()




可以看到，该方法会遍历我们在之前处理Request对象时传入的装着验证类对象的列表，并调用验证类的authenticate()方法，若验证成功生成对应的self.user和self.auth并直接return,往上则直接将生成的self.user进行返回，若验证内部出错，会调用 self._not_ authenticated(), 并抛出错误，往上看，在dispatch方法中，若初始化方法出错，则进行捕获，并调用self.handle_exception()方法生成一个Response对象进行返回，不会执行视图类中对应的方法，则调用对于的是self._not_authenticated()。


def _not_authenticated(self):
  """
  Set authenticator, user & authtoken representing an unauthenticated request.

  Defaults are None, AnonymousUser & None.
  """
  self._authenticator = None

  if api_settings.UNAUTHENTICATED_USER:
   self.user = api_settings.UNAUTHENTICATED_USER()
  else:
   self.user = None

  if api_settings.UNAUTHENTICATED_TOKEN:
   self.auth = api_settings.UNAUTHENTICATED_TOKEN()
  else:
   self.auth = None




UNAUTHENTICATED_USER在django默认配置中为一个匿名用户的类，UNAUTHENTICATED_TOKEN默认为None，若所有验证都为通过或者某一验证过程中出错，则生成一个匿名用户，并将self.auth设置为None。
综上所述，在请求执行之前，DRF框架会根据我们在配置文件中配置的验证类对用户进行身份验证，若未通过验证，则会生成一个匿名用户，验证通过，则生成对应的用户。
以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持。