JWT 认证可以解决 HTTP 无状态认证及跨域登录的问题，常见于不同域名网页使用同一账户登录的解决方案当中，在 Django 中可以使用 JWT 代替 Session 进行认证。Session 一般保存于服务器的数据库中，而 JWT 通过 Token 的形式，将认证结果保存在 cookie 中，二者在保存上存在区别
实现- pyjwt 2.4.0
实现代码如下：
class JWTAuth(View):
"""create token and decode token"""
def post(self, request, *args, **kwargs):
username = request.POST.get('username')
password = request.POST.get('password')
# check username and password
user = authenticate(request, username=username, password=password)
if user is not None and user.is_active:
# use get_jwt_token to create a token
jwt_token = self.get_jwt_token(username)
return JsonResponse({"jwt_toke":jwt_token})
return JsonResponse({"message":"check name and password"})
def get(self, request):
headers = request.headers
# check jwttoken in headers or not
if 'jwttoken' in headers:
# decode token
if self.decode_jwt_token(headers['jwttoken']):
return JsonResponse({"message":"This is Auth page!"})
else:
return JsonResponse({"error":"You get a wrong token"})
else:
return JsonResponse({"error":"You dont have token"})
return JsonResponse({"message":"this is token page!"})
@staticmethod
def get_jwt_token(username):
"""crete jwt token"""
payload={
# Set the expiration time for example 3600 seconds
'exp':datetime.datetime.utcnow() + datetime.timedelta(3600),
'iat':datetime.datetime.utcnow(),
'data':{'username':username},
}
# payload:payload
# string:salt
# algorthm:encryption method
encode_jwt = jwt.encode(payload, "jfjufcb37%jfjoeo", algorithm='HS256')
return encode_jwt
@staticmethod
def decode_jwt_token(encode_jwt):
"""decode jwt """
result = jwt.decode(encode_jwt,"jfjufcb37%jfjoeo", algorithms=['HS256'])
return result
