令牌认证后Django Rest Framework注销不起作用

Question

我已经成功在 django rest 框架中使用令牌身份验证机制进行身份验证，但是当我调用注销函数时，它显示错误 'AnonymousUser' object has no attribute 'auth_token'，不知道为什么返回 AnonymousUser。

## Serializer ##
class AdminLoginSerializer(serializers.Serializer):
    username = serializers.CharField()
    password = serializers.CharField()

    def validate(self, data):
        username = data.get("username", "")
        password = data.get("password", "")

        if username and password:
            user = authenticate(username=username, password=password)
            if user:
                if user.is_active:
                    data["user"] = user
                else:
                    msg = 'User is deactivated'
                    raise exceptions.ValidationError(msg)
            else:
                msg = "Unable to login with given credentials"
                raise exceptions.ValidationError(msg)
        else:
            msg = 'Must Provide Username and password'
            raise exceptions.ValidationError(msg)
        return data

## Viewsets ##

class AdminLoginView(APIView):
    def post(self, request):
        serializer = AdminLoginSerializer(data=request.data)
        serializer.is_valid(raise_exception=True)
        user = serializer.validated_data['user']
        # django_login(request, user)
        token, created = Token.objects.get_or_create(user=user)
        return Response({"token": token.key, 'id': token.user.id}, status=200)


class AdminLogoutView(APIView):
    authentication_classes = [TokenAuthentication]

    def post(self, request):
        # django_logout(request)
        **request.user.auth_token.delete()**
        return Response(status=204)

Answer 1

我认为您没有将新请求中从loginView 获得的令牌提供给logoutView。所以 TokenAuthentication 用 AnonymousUser 填充 request.user。

将IsAuthenticated 权限类添加到您的 LogoutViet 以防止未经身份验证的用户。

from rest_framework import permissions
class AdminLogoutView(APIView):
    permission_classes = [permissions.IsAuthenticated]

另外，检查 TokenAuthentication 例程，并将令牌完全像这样放入请求中。您应该以这样的模式在Authorization HTTP 标头中传递令牌，例如：

Authorization: Token 401f7ac837da42b97f613d789819ff93537bee6a