Django:一个视图的基本身份验证(避免使用中间件)

Question

我需要提供http-basic-auth一个视图.

我想避免修改中间件设置.

背景:这是一个由远程应用程序填充的视图.

Answer 1

当您执行基本身份验证请求时,您实际上是在Authorization标头中添加凭据.在传输之前,这些凭据是base64编码的,因此您需要在收据时解码它们.

以下代码段假定只有一个有效的用户名和密码:

import base64

def my_view(request):
    auth_header = request.META.get('HTTP_AUTHORIZATION', '')
    token_type, _, credentials = auth_header.partition(' ')

    expected = base64.b64encode(b'username:password').decode()

    if token_type != 'Basic' or credentials != expected:
        return HttpResponse(status=401)

    # Your authenticated code here:
    ...

如果您希望与User模型的用户名和密码进行比较,请尝试以下方法:

def my_view(request):
    auth_header = request.META.get('HTTP_AUTHORIZATION', '')
    token_type, _, credentials = auth_header.partition(' ')

    username, password = base64.b64decode(credentials).split(':')
    try:
        user = User.objects.get(username=username)
    except User.DoesNotExist:
        return HttpResponse(status=401)

    password_valid = user.check_password(password)

    if token_type != 'Basic' or not password_valid:
        return HttpResponse(status=401)

    # Your authenticated code here:
    ...

请注意,后一版本不是非常安全.乍一看,我可以看到它很容易受到时间攻击的影响.

Answer 2

您可以尝试自定义装饰器（这似乎是此处和此处的推荐方式），而不是添加新的中间件：

my_app/decorators.py：

import base64

from django.http import HttpResponse
from django.contrib.auth import authenticate
from django.conf import settings


def basicauth(view):
    def wrap(request, *args, **kwargs):
        if 'HTTP_AUTHORIZATION' in request.META:
            auth = request.META['HTTP_AUTHORIZATION'].split()
            if len(auth) == 2:
                if auth[0].lower() == "basic":
                    uname, passwd = base64.b64decode(auth[1]).decode(
                        "utf8"
                    ).split(':', 1)
                    user = authenticate(username=uname, password=passwd)
                    if user is not None and user.is_active:
                        request.user = user
                        return view(request, *args, **kwargs)
        
        response = HttpResponse()
        response.status_code = 401
        response['WWW-Authenticate'] = 'Basic realm="{}"'.format(
            settings.BASIC_AUTH_REALM
        )
        return response
    return wrap

然后用它来装饰你的视图：

from my_app.decorators import basicauth


@basicauth
def my_view(request):
    ...

Answer 3

可以使用此库:https://github.com/hirokiky/django-basicauth

Django的基本auth实用程序.

文档展示了如何使用它:

将装饰器应用于CBV

要将@basic_auth_requried装饰器应用于基于类的视图,请使用django.utils.decorators.method_decorator.

资料来源:https://github.com/hirokiky/django-basicauth#applying-decorator-to-cbvs