How do I create a login API using Django Rest Fram

问题:

I want to create a login api (or use an existing one if it is already pre-bundled) using django rest framework. However, I'm completely at a loss. Whenever I send a post request to the django rest framework "login" url, it just sends back the browsable api template page...

MY CONFIGURATION

urls.py

url(r'^api/v1/', include('rest_framework.urls', namespace='rest_framework'))

settings.py

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.BasicAuthentication',
        'rest_framework.authentication.SessionAuthentication',
    )
}

WHAT I WANT

Request:

POST /api/v1/login  username='name' pass='pass'

Response:

200 OK "{username: 'name', 'userId': '54321'}" set-cookie: sessionid="blahblah"

回答1:

Take a look at the api view from django-rest-framework-jwt. It's an implementation for creating auth tokens rather than cookie sessions, but your implementation will be similar. See views.py and serializers.py. You can probably use the serializers.py unchanged, and just adjust your views to return the right parameters and possibly set the session cookie (can't recall if that's already performed in authentication).

回答2:

If you want something like this I do the same thing however I use Token authentication.

Check out their token page here

This may not be what you want but the way I do it is (since I'm using it as a rest api endpoints for mobile clients)

I can do my url localhost:8000/api/users/ -H Authorization : Token A browser could then use the regular login page that you create at the provided rest framework url

url(r'^api-auth/', include('rest_framework.urls', namespace='rest_framework')

and to get tokens for 'login-less' navigation

url(r'^api-token-auth/', 'rest_framework.authtoken.views.obtain_auth_token')

Then if you make calls and such you can pass the authorization tokens. Of course this is just how I do it and it's probably not the most efficient way but my goal was to create a way that I can provide users with session authentication for browsers and mobile access via tokens.

Then in your views.py make sure you add the authentication requirements for that view. Almost the same as session authentication section

permission_classes = (permissions.IsAdminUser,)

but also include

authentication_classes = (authentication.TokenAuthentication,)

I hope this helps but if not, good luck on your search.

回答3:

Of course token is a good way to authenticate, but questioner is asking about session authentication.

Request:

POST /api/v1/login  username='username' password='password' 

• Put csrftoken value at X-CSRFToken in header
• Even though someone using email as username filed, username name parameter is required for email input (e.g. username='[e-mail]')

Response:

302 FOUND sessionid="blahblah"

• If you not specified next value, it will automatically redirect into /accounts/profile/ which can yield 404 error

回答4:

Adding our views:

from rest_framework_jwt.views import refresh_jwt_token

urlpatterns = [
    ...
    url(r'^rest-auth/', include('rest_auth.urls')),
    url(r'^rest-auth/registration/', include('rest_auth.registration.urls')),
    ...
    url(r'^refresh-token/', refresh_jwt_token),
]