Django REST 用户创建/身份验证

Question

本题基于here。我正在为我的 Web 应用程序设置 Django REST 框架，并尝试设置用户帐户。根据 REST 文档，他们将所有帐户代码放在主项目目录中的示例中，并在一个单独的应用程序中也这样做了。这是我所拥有的：

urls.py

from django.contrib import admin
from django.urls import include, path
from django.conf.urls import url
from rest_framework import routers
from . import views

router = routers.DefaultRouter()
router.register('users', views.UserViewSet)

urlpatterns = [
    path('admin/', admin.site.urls),
    url('', include(router.urls)),
    url(r'^api-auth/', include('rest_framework.urls', namespace='rest_framework')),
]

序列化器.py

from django.contrib.auth.models import User
from rest_framework import serializers


class UserSerializer(serializers.ModelSerializer):
    password = serializers.CharField(write_only=True)

    def create(self, validated_data):
        user = User.objects.create(
            username=validated_data['username']
        )
        user.set_password(validated_data['password'])
        user.save()

        return user

    class Meta:
        model = User
        # Tuple of serialized model fields (see link [2])
        fields = ( "id", "username", "password", )

views.py

from rest_framework import viewsets, permissions
from rest_framework.generics import CreateAPIView
from django.contrib.auth.models import User
from .serializers import UserSerializer


# Create your views here.
class UserViewSet(viewsets.ModelViewSet):
    queryset = User.objects.all()
    serializer_class = UserSerializer
    permission_classes = [permissions.IsAuthenticated]


class CreateUserView(CreateAPIView):
    model = User
    permission_classes = [
        permissions.AllowAny
    ]
    serializer_class = UserSerializer

我曾尝试在 Chrome 中使用 Boomerang REST 客户端向此 API 发布数据，但它总是返回 403 错误，提示“用户名/密码无效”。具体来说，我使用查询字符串和 2 个参数发送到 http://127.0.0.1:8000/users/create/：用户名和密码。我也尝试将它作为 JSON 发送，它返回相同。任何帮助将不胜感激。

Answer 1

您的urls.py 中似乎没有注册CreateUserView。您应该能够注册并正常访问它。我认为这应该适合你：

urlpatterns = [
    ...
    url(r'^users/create/', views.CreateUserView.as_view()),
]

---

也就是说，我建议为您的UserViewSet 添加一个extra action：

# Create your views here.
class UserViewSet(viewsets.ModelViewSet):
    queryset = User.objects.all()
    serializer_class = UserSerializer
    permission_classes = [permissions.IsAuthenticated

    @action(methods=['post'], detail=False, permission_classes=[permissions.AllowAny])
    def register(self, request, *args, **kwargs):
        # This logic was taken from the `create` on `ModelViewSet`. Alter as needed.
        serializer = self.get_serializer(data=request.data)
        serializer.is_valid(raise_exception=True)
        self.perform_create(serializer)
        headers = self.get_success_headers(serializer.data)
        return Response(serializer.data, status=status.HTTP_201_CREATED, headers=headers)

那么您应该可以通过/users/register/ 发帖。你也可以在装饰器上specify your own url name and path。

Answer 2

也许你发错了网址，试试在http://127.0.0.1:8000/users/上发布相同的内容， 因为ModelViewSet 会自动添加POST, PATCH, PUT, DELETE and GET 方法。

另外，因为您要求进行身份验证 (permission_classes = [permissions.IsAuthenticated])，您应该在请求中发送此标头。在 DRF 网站 (https://www.django-rest-framework.org/tutorial/4-authentication-and-permissions/) 中有一个关于此的教程

Answer 3

基于 django-rest-framework documents 最好使用 viewset 来创建用户 api。因此，您需要向http://127.0.0.1:8000/api-auth/users 发送POST 请求，而无需CreateUserView 函数。

但是，如果您想要自定义用户创建 api，您是否需要以下内容：

class UserViewSet(viewsets.ModelViewSet):
    """
    A viewset that provides the standard actions
    """
    queryset = User.objects.all()
    serializer_class = UserSerializer

    @action(detail=True, methods=['post'], permission_classes=[permissions.AllowAny])
    def create_user(self, request, pk=None):
        serializer = self.get_serializer(data=request.data)
        serializer.is_valid(raise_exception=True)
        self.perform_create(serializer)
        headers = self.get_success_headers(serializer.data)
        return Response(serializer.data, status=status.HTTP_201_CREATED, headers=headers)

要在 ViewSet 中包含自定义序列化程序，您可以在 ViewSet 的 get_serializer_class 函数中指定它们，如下所示：

class UserViewSet(viewsets.ModelViewSet):
# example viewset
    def get_serializer_class(self):
        if self.action == 'list':
            return ListUserSerializer
        elif self.action == 'create':
            return CreateUserSerializer
        elif self.action == 'update':
            return UpdateUserSerializer
        return DetailUserSerializer