Question

我需要编写一个在django-restframework 3.0上提供SessionAuthentication和TokenAuthentication的类

这意味着 - 如果用户拥有有效会话或，则会对其进行身份验证。

我有两个课程，但我不知道如何组合它们：权标：

def authenticate(self, request):

    auth = get_authorization_header(request).split()

    if not auth or auth[0].lower() != self.keyword.lower().encode():
        return None

    if len(auth) == 1:
        msg = _('Invalid token header. No credentials provided.')
        raise exceptions.AuthenticationFailed(msg)
    elif len(auth) > 2:
        msg = _('Invalid token header. Token string should not contain spaces.')
        raise exceptions.AuthenticationFailed(msg)

SESSION：

def authenticate(self, request):
    """
    Returns a `User` if the request session currently has a logged in user.
    Otherwise returns `None`.
    """

    # Get the session-based user from the underlying HttpRequest object
    user = getattr(request._request, 'user', None)

    # Unauthenticated, CSRF validation not required
    if not user or not user.is_active:
        return None

我也尝试过settings.py：

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.SessionAuthentication',
        'rest_framework.authentication.TokenAuthentication',
    )
}

但它没有用，我认为这是检查令牌 AND 会话..

有什么想法吗？

Django - 自定义Auth类，令牌或会话

0 个答案: