【发布时间】：2013-12-29 11:24:15
【问题描述】：
所以，我似乎可以从浏览器中很好地执行此操作，但我似乎无法通过 CURL 复制它。任何关于这应该如何工作的指针都非常感谢。
我执行此请求以登录用户：
curl -X POST -H "Content-Type: application/json" \
-d '{"username":"tester", "password":"password"}' --verbose \
http://localhost:8000/api/user/login/
并且响应似乎表明请求成功：
* About to connect() to localhost port 8000 (#0)
* Trying 127.0.0.1... connected
> POST /api/user/login/ HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: localhost:8000
> Accept: */*
> Content-Type: application/json
> Content-Length: 44
>
* upload completely sent off: 44out of 44 bytes
< HTTP/1.1 200 OK
< Server: nginx/1.1.19
< Date: Wed, 11 Dec 2013 12:31:34 GMT
< Content-Type: application/json
< Transfer-Encoding: chunked
< Connection: keep-alive
< Vary: Accept, Cookie
< Set-Cookie: csrftoken=h4tjM6o3QyelsAvUhdqNJPinZRdJyrBz; Path=/
< Set-Cookie: sessionid=4tsny8kcl7j9x7icr6vptnq1ims89tzr; expires=Wed, 25-Dec-2013 12:31:34 GMT; httponly; Max-Age=1209600; Path=/
<
* Connection #0 to host localhost left intact
* Closing connection #0
{"success": true, "username": "tester"}
如果我在经过身份验证的请求中仅包含 CSRF 令牌，则会收到 401。但是，如果我同时包含 CSRF 令牌和会话 ID，则会收到某种 Python 错误。例如：
curl -X GET -H "Content-Type: application/json" -H \
"X-CSRFToken: h4tjM6o3QyelsAvUhdqNJPinZRdJyrBz" --cookie \
"sessionid=4tsny8kcl7j9x7icr6vptnq1ims89tzr" --verbose \
http://localhost:8000/api/user/ | python -mjson.tool \
我从服务器返回：
{
"error_message": "getattr(): attribute name must be string",
"traceback": "Traceback (most recent call last):
File \"/opt/phaidra/env/local/lib/python2.7/site-packages/tastypie/resources.py\", line 195, in wrapper\n response = callback(request, *args, **kwargs)\n\n
File \"/opt/phaidra/env/local/lib/python2.7/site-packages/tastypie/resources.py\", line 426, in dispatch_list\n return self.dispatch('list', request, **kwargs)\n\n
File \"/opt/phaidra/env/local/lib/python2.7/site-packages/tastypie/resources.py\", line 454, in dispatch\n self.throttle_check(request)\n\n
File \"/opt/phaidra/env/local/lib/python2.7/site-packages/tastypie/resources.py\", line 551, in throttle_check\n identifier = self._meta.authentication.get_identifier(request)\n\n
File \"/opt/phaidra/env/local/lib/python2.7/site-packages/tastypie/authentication.py\", line 515, in get_identifier\n return request._authentication_backend.get_identifier(request)\n\n
File \"/opt/phaidra/env/local/lib/python2.7/site-packages/tastypie/authentication.py\", line 283, in get_identifier\n return getattr(request.user, username_field)\n\n
TypeError: getattr(): attribute name must be string\n"
}
查看错误的线条并不是特别有启发性。由于除非使用 --cookie 否则不会发生此错误，因此我假设它尝试错误地解析 cookie 参数。
还应该注意的是，我使用的是 Neo4django，我认为这使我无法使用 API 密钥身份验证。我的用户的代码是这样的：
class UserResource(ModelResource):
class Meta:
queryset = AppUser.objects.all()
resource_name = 'user'
fields = ['first_name', 'last_name', 'username', 'email', 'is_staff']
allowed_methods = ['get', 'post', 'patch']
always_return_data = True
authentication = MultiAuthentication(SessionAuthentication(), BasicAuthentication())
authorization = Authorization()
def prepend_urls(self):
params = (self._meta.resource_name, trailing_slash())
return [
url(r"^(?P<resource_name>%s)/login%s$" % params, self.wrap_view('login'), name="api_login"),
url(r"^(?P<resource_name>%s)/logout%s$" % params, self.wrap_view('logout'), name="api_logout")
]
def login(self, request, **kwargs):
"""
Authenticate a user, create a CSRF token for them, and return the user object as JSON.
"""
self.method_check(request, allowed=['post'])
data = self.deserialize(request, request.raw_post_data, format=request.META.get('CONTENT_TYPE', 'application/json'))
username = data.get('username', '')
password = data.get('password', '')
if username == '' or password == '':
return self.create_response(request, {
'success': False,
'error_message': 'Missing username or password'
})
user = authenticate(username=username, password=password)
if user:
if user.is_active:
login(request, user)
response = self.create_response(request, {
'success': True,
'username': user.username
})
response.set_cookie("csrftoken", get_new_csrf_key())
return response
else:
return self.create_response(request, {
'success': False,
'reason': 'disabled',
}, HttpForbidden)
else:
return self.create_response(request, {
'success': False,
'error_message': 'Incorrect username or password'
})
def read_list(self, object_list, bundle):
"""
Allow the endpoint for the User Resource to display only the logged in user's information
"""
self.is_authenticated(request)
return object_list.filter(pk=bundle.request.user.id)
（如果需要，您可以在https://github.com/OpenPhilology/phaidra/blob/master/api/api.py查看文件的全部内容）
所以，总而言之，我的主要问题/困惑点：
- 必须通过 curl 请求发送哪些数据才能发送经过身份验证的 GET/POST/等？
- 用户资源的身份验证值是否正确？
- 我应该能够仅使用 CSRF 令牌进行身份验证，还是会话 ID 也是必需的？
提前感谢您对此的任何见解！
编辑： 这是我们拥有的自定义用户模型。
from django.contrib.auth import authenticate
from django.db import models as django_models
from neo4django.db import models
from neo4django.graph_auth.models import User, UserManager
class AppUser(User):
objects = UserManager()
USERNAME_FIELD = 'username'
def __unicode__(self):
return unicode(self.username) or u''
【问题讨论】：
标签： python authentication curl tastypie neo4django