python - 根据 header 身份验证 token 过滤 API 请求

Question

我想根据随 GET 请求发送的 token header 来过滤对象。

我的请求正在 header 中发送 token ( get curl -H "Authorization: Token 3f3f3fzzz" https://1.com/api )

下面的代码不返回任何结果(只是一个空数组 - 没有错误)。我无法确定我的请求对象 header 在哪里。

我的猜测是，我需要一些中间件函数来改变响应并将用户对象也放入其中。

views.py

class AllViewSet(viewsets.ModelViewSet):
    queryset = Movie.objects.order_by('-created',)
    serializer_class = AllSerializer
    def get_queryset(self):
        Movie.objects.filter(owner = self.request.user)

我在 def_queryset 之后尝试了一些调试(使用 import pdb; pdb.set_trace() )。

def(sel.request)返回:http://dpaste.com/2VQARE3

这是我的代码中可能相关的其他部分。

models.py

@receiver(post_save, sender=settings.AUTH_USER_MODEL)
def create_auth_token(sender, instance=None, created=False, **kwargs):
    if created:
        Token.objects.create(user=instance)

class Movie(models.Model):
    title = models.CharField("Title", max_length=10000, blank=True)
    tag = models.ManyToManyField('Tag', blank=True)
    created = models.DateTimeField("Created", auto_now_add=True)
    owner = models.ForeignKey('auth.User', blank=True, null=True)

设置.py

REST_FRAMEWORK = {
    'DEFAULT_FILTER_BACKENDS': ('rest_framework.filters.DjangoFilterBackend',),
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
    ),
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.TokenAuthentication',
    )
}

MIDDLEWARE_CLASSES = (
    'django.contrib.sessions.middleware.SessionMiddleware',
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    'django.middleware.security.SecurityMiddleware',
)

Answer 1

您可以编写自定义过滤器后端 http://www.django-rest-framework.org/api-guide/filtering/#custom-generic-filtering

from rest_framework import filters
class OwnerFilterBackend(filters.BaseFilterBackend):
    def filter_queryset(self, request, queryset, view):
        return queryset.filter(owner=request.user)

class AllViewSet(viewsets.ModelViewSet):
    filter_backends = (OwnerFilterBackend,)
    ...