python -m venv venv

pip install django
pip install django-cors-headers # 跨域
pip install djangorestframework 
pip install pyjwt
pip install django-simpleui # 后台UI框架 选用

# 创建一个Django项目
django-admin startapp project

# 创建一个App
python manage.py startapp accounts

# Settings.py
INSTALLED_APPS = [
    ...
    # 插件
    'corsheaders',
    'rest_framework',

    #Apps
    'accounts',
]

CORS_ALLOW_CREDENTIALS = True  # 通过ajax请求接受cookie

REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated', # 使所有端口私有
    )
}

# (accounts)models.py
from django.db import models

from django.contrib.auth.models import AbstractUser

class User(AbstractUser):
    pass

---
AUTH_USER_MODEL = 'accounts.User' # accounts这个下的User模型
---

from django.conf import settings
User = settings.AUTH_USER_MODEL

# 或者

from django.contrib.auth import get_user_model
User = get_user_model()

# (accounts)admin.py
from django.contrib import admin
from django.contrib.auth.admin import UserAdmin
from accounts.models import User

admin.site.register(User, UserAdmin)

makemigrations # 生成迁移模型

migrate

createsuperuser # 创建用户

from rest_framework import serializers
from .models import User # 导入模型

class UserSerializer(serializers.ModelSerializer):
    class Meta:
        model = User
        fields = ['id', 'username', 'email', 'first_name', 'last_name', 'is_active']
        # 或者排除掉密码
        # exclude = ['password']

# 根目录/urls.py
from django.urls import path, include

urlpatterns = [
    path('accounts/', include('accounts.urls')), # 引入App/accounts
]


# APP(accounts).url
urlpatterns = [
    path('profile', profile, name='profile')
]

from rest_framework.decorators import api_view
from rest_framework.response import Response
from .serializers import UserSerializer # 导入序列化


'''
    获取用户信息视图
'''
@api_view(['GET'])
def profile(request):
    user = request.user
    serialized_user = UserSerializer(user).data
    return Response({'user': serialized_user })

from django.shortcuts import render
from rest_framework.views import  APIView
from rest_framework.response import Response
from .serializers import *

from django.contrib.auth import get_user_model
from rest_framework import exceptions
from rest_framework.permissions import AllowAny
from django.views.decorators.csrf import  ensure_csrf_cookie
from .utils import *
from .authentications import JWTAuthentication


'''
    获取用户信息
'''
class Profile(APIView):
    authentication_classes = [JWTAuthentication]
    def get(self, request):
        user = request.user
        serialized_user = UserSerializer(user).data
        return Response({'user': serialized_user})
'''
    登录视图
'''
class Login(APIView):
    permission_classes = [AllowAny]
    authentication_classes = [JWTAuthentication]

    def get(self, request):
        return render(request, 'login.html')

    def post(self, request):
        User = get_user_model()
        username = request.data.get('username')
        password = request.data.get('password')
        print(username, password)

        response = Response()
        if (username is None) or (password is None):
            raise exceptions.AuthenticationFailed('用户名或密码为空')

        user = User.objects.filter(username=username).first()

        if (user is None):
            raise exceptions.AuthenticationFailed('用户未找到')
        if (not user.check_password(password)):
            raise exceptions.AuthenticationFailed('密码错误')

        serialized_user = UserSerializer(user).data

        access_token = generate_access_token(user)
        refresh_token = generate_refresh_token(user)
        print(access_token)
        print(refresh_token)

        response.set_cookie(key='refreshtoken', value=refresh_token, httponly=True)

        response.data = {
            'access_token': access_token,
            'user': serialized_user
        }

        return response

from rest_framework.authtoken.serializers import AuthTokenSerializer

def post(self,request):
    serializer = AuthTokenSerializer(data=request.data) # 序列化
    if serializer.is_valid():
        user = serializer.validated_data.get('user')
        user.last_login = now() # 记录用户最后登录时间6
        user.save()
        token = generate_jwt(user)
        user_serializer = UserSerializer(user)
        return Response({"token":token,"user":user_serializer.data})

import datetime
import jwt
from django.conf import settings

'''
    生成登录成功Token
'''
def generate_access_token(user):

    access_token_payload = {
        'user_id': user.id,
        'exp': datetime.datetime.utcnow() + datetime.timedelta(days=0, minutes=5),#5分
        'iat': datetime.datetime.utcnow(),
    }
    access_token = jwt.encode(access_token_payload,
                              settings.SECRET_KEY, algorithm='HS256').decode('utf-8')
    return access_token


def generate_refresh_token(user):
    refresh_token_payload = {
        'user_id': user.id,
        'exp': datetime.datetime.utcnow() + datetime.timedelta(days=7),# 7天
        'iat': datetime.datetime.utcnow()
    }
    refresh_token = jwt.encode(
        refresh_token_payload, settings.SECRET_KEY, algorithm='HS256').decode('utf-8')

    return refresh_token

from rest_framework.authentication import TokenAuthentication,

from rest_framework.authentication import BaseAuthentication, TokenAuthentication, get_authorization_header
from rest_framework import exceptions
import jwt
from django.conf import settings
from django.contrib.auth import get_user_model

User = get_user_model()

# 1. 继承BaseAuthentication
class JWTAuthentication(BaseAuthentication):
    '''
    自定义头
    Authorization: JWT 401f7ac837da42b97f613d789819ff93537bee6a
    '''
    keyword = 'JWT'
    model = None


    def authenticate(self, request):
        # 拿到jwt值
        auth = get_authorization_header(request).split()
        

        if not auth or auth[0].lower() != self.keyword.lower().encode():
            return None

        if len(auth) == 1:
            msg = '认证失败'
            raise exceptions.AuthenticationFailed(msg)
        elif len(auth) > 2:
            msg = '应该提供一个空格'
            raise exceptions.AuthenticationFailed(msg)

        try:
            jwt_token = auth[1]
            # 解码
            jwt_info = jwt.decode(jwt_token, settings.SECRET_KEY, algorithms=['HS256'])
            # 提取用户ID 对应加密的user_id
            user_id = jwt_info.get('user_id')
            try:
                user = User.objects.get(pk=user_id)
                return (user, None)
            except:
                msg = '用户名不存在'
                raise exceptions.AuthenticationFailed(msg)

        except jwt.ExpiredSignatureError:
            msg = 'Token 过期'
            raise exceptions.AuthenticationFailed(msg)

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'accounts.authentications.JWTAuthentication',# APP.文件名.类名
    ),
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated', # 使所有端口私有
    ),
}

import jwt
class RefreshTokenView(APIView):
    permission_classes = [AllowAny]

    def post(self, request):
        '''
         To obtain a new access_token this view expects 2 important things:
        1. a cookie that contains a valid refresh_token
        2. a header 'X-CSRFTOKEN' with a valid csrf token, client app can get it from cookies "csrftoken"
        '''
        User = get_user_model()
        refresh_token = request.COOKIES.get('refreshtoken')
        if refresh_token is None:
            raise  exceptions.AuthenticationFailed('没有提供身份验证凭据')

        try:
            payload = jwt.decode(refresh_token, settings.SECRET_KEY, algorithms=['HS256'])
        except jwt.ExpiredSignatureError:
            raise exceptions.AuthenticationFailed('过期的刷新令牌，请重新登录')

        user = User.objects.filter(id = payload.get('user_id')).first()
        if user is None:
            raise exceptions.AuthenticationFailed('用户未找到')

        access_token = generate_access_token(user)
        return Response({'access_token': access_token})