django认证系统 Authentication使用详解

> from django.contrib.auth.models import User
> user = User.objects.create_user('john', 'lennon@thebeatles.com', 'johnpassword')
# 这时，user是一个User类的实例，已经保存在了数据库内，你可以随时修改它的属性，例如：
> user.last_name = 'Lennon'
> user.save()

$ python manage.py createsuperuser

$ python manage.py createsuperuser --username=joe --email=joe@example.com

from django.contrib.auth.models import User
u = User.objects.get(username='john')
u.set_password('new password')
u.save()

from django.contrib.auth import authenticate
user = authenticate(username='john', password='secret')
if user is not None:
  # A backend authenticated the credentials
else:
  # No backend authenticated the credentials

myuser.groups.set([group_list])
myuser.groups.add(group, group, ...)
myuser.groups.remove(group, group, ...)
myuser.groups.clear()
myuser.user_permissions.set([permission_list])
myuser.user_permissions.add(permission, permission, ...)
myuser.user_permissions.remove(permission, permission, ...)
myuser.user_permissions.clear()

add: user.has_perm('foo.add_bar')
change: user.has_perm('foo.change_bar')
delete: user.has_perm('foo.delete_bar')

from myapp.models import BlogPost
from django.contrib.auth.models import Permission
from django.contrib.contenttypes.models import ContentType

content_type = ContentType.objects.get_for_model(BlogPost)
permission = Permission.objects.create(
  codename='can_publish',
  name='Can Publish Posts',
  content_type=content_type,
)

from django.contrib.auth.models import Permission, User
from django.shortcuts import get_object_or_404

def user_gains_perms(request, user_id):
  user = get_object_or_404(User, pk=user_id)
  # any permission check will cache the current set of permissions
  user.has_perm('myapp.change_bar')

  permission = Permission.objects.get(codename='change_bar')
  user.user_permissions.add(permission)

  # Checking the cached permission set
  user.has_perm('myapp.change_bar') # False

  # Request new instance of User
  # Be aware that user.refresh_from_db() won't clear the cache.
  user = get_object_or_404(User, pk=user_id)

  # Permission cache is repopulated from the database
  user.has_perm('myapp.change_bar') # True

  ...

if request.user.is_authenticated:
# Do something for authenticated users.
...
else:
  # Do something for anonymous users.
  ...

from django.contrib.auth import authenticate, login

def my_view(request):
  username = request.POST['username']
  password = request.POST['password']
  user = authenticate(username=username, password=password)
  if user is not None:
    login(request, user)
    # 跳转到成功页面
    ...
  else:
    # 返回一个非法登录的错误页面
    ...

from django.contrib.auth import logout

def logout_view(request):
  logout(request)
  # Redirect to a success page.

from django.conf import settings
from django.shortcuts import redirect

def my_view(request):
  if not request.user.is_authenticated:
    return redirect('%s"htmlcode">

from django.shortcuts import render

def my_view(request):
  if not request.user.is_authenticated:
    return render(request, 'myapp/login_error.html')
  # ...


2. 使用装饰器


原型：login_required(redirect_field_name='next', login_url=None)[source]
被该装饰器装饰的视图，强制要求用户必须登录后才可以访问。


from django.contrib.auth.decorators import login_required

@login_required
def my_view(request):
  ...


该装饰器工作机制：

  
如果用户未登陆，重定向到settings.LOGIN_URL，传递当前绝对路径作为url字符串的参数，例如：/accounts/login/"htmlcode">

from django.contrib.auth.decorators import login_required

@login_required(redirect_field_name='my_redirect_field')
def my_view(request):
  ...


如果你这么做了，你还需要重新定制登录模板，因为它引用了redirect_field_name变量。
login_required()装饰器还有一个可选的longin_url参数。例如：


from django.contrib.auth.decorators import login_required

@login_required(login_url='/accounts/login/')
def my_view(request):
  ...


注意：如果不指定login_url参数，请确保你的settings.LOGIN_URL和登陆视图保持正确的关联。例如：


from django.contrib.auth import views as auth_views
url(r'^accounts/login/$', auth_views.login),


3. 使用LoginRequired mixin


通过继承LoginRequiredMixin类的方式限制用户。在多继承时，该类必须是最左边的父类。


from django.contrib.auth.mixins import LoginRequiredMixin

class MyView(LoginRequiredMixin, View):
  login_url = '/login/'
  redirect_field_name = 'redirect_to'


4. 进行测试，根据结果决定动作


也可以直接在视图中进行过滤：


from django.shortcuts import redirect

def my_view(request):
  if not request.user.email.endswith('@example.com'):
    return redirect('/login/"htmlcode">

from django.contrib.auth.decorators import permission_required

@permission_required('polls.can_vote')
def my_view(request):
  ...


权限的格式是<app label>.<permission codename>。
该装饰器还有一个可选的longin_url参数：


from django.contrib.auth.decorators import permission_required

@permission_required('polls.can_vote', login_url='/loginpage/')
def my_view(request):
  ...


4. 认证视图


Django为我们提供了一系列认证相关的视图，可以直接拿来用，这样你就不需要自己写登录、注销、注册等视图。但是，但是，Django没有为认证视图提供默认的模板，你需要自己写......。
所以，除非懒癌发作，还是老老实实自己写认证相关的视图、路由和模板吧。个人认为类似跟实际生产环境结合非常紧密的视图，根本不需要这种鸡肋的内置视图，到最后，你发现还是要自己写才能满足需求。
所以，后面的部分就不赘述了！
以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持。