JWT认证系统尝鲜

// Header
{
  "alg": "HS256",
  "typ": "JWT"
}

// Payload
{
  // reserved claims
  "iss": "a.com",
  "exp": "1d",
  // public claims
  "http://a.com": true,
  // private claims
  "company": "A",
  "awesome": true
}

// $Signature
HS256(Base64(Header) + "." + Base64(Payload), secretKey)

// JWT
JWT = Base64(Header) + "." + Base64(Payload) + "." + $Signature

@api_view(["POST"])
@authentication_classes(())
@permission_classes(())
@excepts
def login_view(request):
    """
    用于账户登录接口
    :param request:
    :return:
    """
    res = {
        "code": "00000000",
        "data": {}
    }

    username = request.POST.get('username')
    password = request.POST.get('password')
    remember = request.POST.get('remember')

    jwt_payload_handler = token_settings.JWT_PAYLOAD_HANDLER # 关键代码
    jwt_encode_handler = token_settings.JWT_ENCODE_HANDLER # 关键代码

    user = authenticate(request, username=username, password=password)
    if user is not None:
        login(request, user)
        if not remember:
            token_settings.JWT_EXPIRATION_DELTA = datetime.timedelta(hours=3) # 暂不生效后续需要改动

        payload = jwt_payload_handler(user)
        token = jwt_encode_handler(payload)
        res['data']['token'] = token
        return JsonResponse(res)
    else:
        raise AuthenticateError("Username or Password is incorrect!")

JWT_AUTH = {
    'JWT_ENCODE_HANDLER':
    'rest_framework_jwt.utils.jwt_encode_handler',

    'JWT_DECODE_HANDLER':
    'rest_framework_jwt.utils.jwt_decode_handler',

    'JWT_PAYLOAD_HANDLER':
    'rest_framework_jwt.utils.jwt_payload_handler',

    'JWT_PAYLOAD_GET_USER_ID_HANDLER':
    'rest_framework_jwt.utils.jwt_get_user_id_from_payload_handler',

    'JWT_RESPONSE_PAYLOAD_HANDLER':
    'rest_framework_jwt.utils.jwt_response_payload_handler',

    'JWT_SECRET_KEY': SECRET_KEY,
    'JWT_GET_USER_SECRET_KEY': None,
    'JWT_PUBLIC_KEY': None,
    'JWT_PRIVATE_KEY': None,
    'JWT_ALGORITHM': 'HS256',
    'JWT_VERIFY': True,
    'JWT_VERIFY_EXPIRATION': True,
    'JWT_LEEWAY': 0,
    'JWT_EXPIRATION_DELTA': datetime.timedelta(days=1),
    'JWT_AUDIENCE': None,
    'JWT_ISSUER': None,

    'JWT_ALLOW_REFRESH': False,
    'JWT_REFRESH_EXPIRATION_DELTA': datetime.timedelta(days=7),

    'JWT_AUTH_HEADER_PREFIX': 'Bearer',  # 就是这个地方！！！！！！
    'JWT_AUTH_COOKIE': None,
}

// app.module.ts
// #region Http Interceptors
import { HTTP_INTERCEPTORS } from '@angular/common/http';
import { JWTInterceptor } from '@delon/auth';
import { DefaultInterceptor } from '@core/net/default.interceptor';
const INTERCEPTOR_PROVIDES = [
  { provide: HTTP_INTERCEPTORS, useClass: DefaultInterceptor, multi: true },
  { provide: HTTP_INTERCEPTORS, useClass: JWTInterceptor, multi: true },
];
// #endregion

// startup.service.ts
...
// 启动的时候判断当前有没有存储 token 值，如果存储则直接跳转到首页，否则跳转到登录页面
  const tokenData = this.tokenService.get(JWTTokenModel);
  if (tokenData.token) {
    this.httpClient.get('accounts/current/').subscribe(userData => {
      // User information: including name, avatar, email address
      const {
        data: { profile, authority, permission },
      } = userData as any;

      // 设置用户的认证信息
      this.sessionStorageService.store('authority', authority);
      this.sessionStorageService.store('permission', permission);

      this.settingService.setUser(profile);
    });
  }
...

  submitLogin() {
    this.username.markAsDirty();
    this.username.updateValueAndValidity();
    this.password.markAsDirty();
    this.password.updateValueAndValidity();
    if (this.username.invalid || this.password.invalid) {
      return;
    }

    const formData = new FormData();
    formData.append('username', this.username.value);
    formData.append('password', this.password.value);
    formData.append('remember', this.remember.value);

    // 默认配置中对所有HTTP请求都会强制 [校验](https://ng-alain.com/auth/getting-started) 用户 Token
    // 然一般来说登录请求不需要校验，因此可以在请求URL加上：`/login?_allow_anonymous=true` 表示不触发用户 Token 校验
    this.http.post('accounts/login/?_allow_anonymous=true', formData).subscribe((res: any) => {
      // 保存用户的 token 信息在缓存里面
      this.tokenService.set(res.data);

      // 重新获取 StartupService 内容，我们始终认为应用信息一般都会受当前用户授权范围而影响
      this.startupService.load().then(() => {
        let url = this.tokenService.referrer!.url || '/';
        if (url.includes('/passport')) {
          url = '/';
        }
        this.router.navigateByUrl(url);
      });
    });
  }