Django-REST-framework 用户认证源码分析

# REST的dispatch
def dispatch(self, request, *args, **kwargs):
    """
    `.dispatch()` is pretty much the same as Django's regular dispatch,
    but with extra hooks for startup, finalize, and exception handling.
    """
    self.args = args
    self.kwargs = kwargs
    request = self.initialize_request(request, *args, **kwargs)
    self.request = request
    self.headers = self.default_response_headers  # deprecate?

    try:
        self.initial(request, *args, **kwargs)

        # Get the appropriate handler method
        if request.method.lower() in self.http_method_names:
            handler = getattr(self, request.method.lower(),
                                self.http_method_not_allowed)
        else:
            handler = self.http_method_not_allowed

        response = handler(request, *args, **kwargs)

    except Exception as exc:
        response = self.handle_exception(exc)

    self.response = self.finalize_response(request, response, *args, **kwargs)
    return self.response

    def initialize_request(self, request, *args, **kwargs):
        """
        Returns the initial request object.
        """
        parser_context = self.get_parser_context(request)
        return Request(
            request,
            parsers=self.get_parsers(), # 解析器
            authenticators=self.get_authenticators(), # 用于身份验证
            negotiator=self.get_content_negotiator(),
            parser_context=parser_context
        )

class Request(object):

    def __init__(self, request, parsers=None, authenticators=None,
                 negotiator=None, parser_context=None):
        pass
        self._request = request
        self.parsers = parsers or ()
        # ...

def get_authenticators(self):
    """
    Instantiates and returns the list of authenticators that this view can use.
    """
    return [auth() for auth in self.authentication_classes]

authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES

path('shop/', views.ShopView.as_view())

def initial(self, request, *args, **kwargs):

    self.format_kwarg = self.get_format_suffix(**kwargs)
    # 执行内容协商并存储关于请求的接受信息
    neg = self.perform_content_negotiation(request)
    request.accepted_renderer, request.accepted_media_type = neg

    # 版本控制
    version, scheme = self.determine_version(request, *args, **kwargs)
    request.version, request.versioning_scheme = version, scheme
    # 用户认证
    self.perform_authentication(request)
    # 权限控制
    self.check_permissions(request)
    # 访问频率控制
    self.check_throttles(request)

def perform_authentication(self, request):
    request.user

@property
def user(self):
    if not hasattr(self, '_user'):
        # 只是一个上下文管理器，方便清理之类的工作
        with wrap_attributeerrors():
            self._authenticate()
    return self._user

    def _authenticate(self):
       
        for authenticator in self.authenticators:
            try:
                user_auth_tuple = authenticator.authenticate(self)
            except exceptions.APIException:
                self._not_authenticated()
                raise

            if user_auth_tuple is not None:
                self._authenticator = authenticator
                self.user, self.auth = user_auth_tuple
                return

        self._not_authenticated()

def authenticate(self, request):
    raise NotImplementedError(".authenticate() must be overridden.")

def _not_authenticated(self):
    """
    设置authenticator，user&authToken表示未经过身份验证的请求。
    默认值为None，AnonymousUser&None。
    """
    self._authenticator = None

    if api_settings.UNAUTHENTICATED_USER:
        self.user = api_settings.UNAUTHENTICATED_USER()
    else:
        self.user = None

    if api_settings.UNAUTHENTICATED_TOKEN:
        self.auth = api_settings.UNAUTHENTICATED_TOKEN()
    else:
        self.auth = None

authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES

def reload_api_settings(*args, **kwargs):
    setting = kwargs['setting']
    if setting == 'REST_FRAMEWORK':
        api_settings.reload()

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': ['demo.utils.MyAuthentication.MyAuthentication']
}