Django的基本身份验证不起作用

Question

我在使用 django 的基本身份验证时遇到问题，这是我的配置：

MIDDLEWARE_CLASSES = [
    'request_id.middleware.RequestIdMiddleware',
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.auth.middleware.RemoteUserMiddleware', # <<<<<===
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

AUTHENTICATION_BACKENDS  = [
    'django.contrib.auth.backends.RemoteUserBackend',
    'django.contrib.auth.backends.ModelBackend',
]

我的看法：

def api_list_things(request, intake_id=None):
    if not request.user.is_authenticated():
        return JsonResponse({'message': 'Not authenticated'}, status=403)
    return JsonResponse({'message': 'ok'})

但是当我执行curl -v http://user:pass@localhost:8000/api/list_things/ 时，我得到了未经身份验证的错误：

* Hostname was NOT found in DNS cache                    
*   Trying ::1...                                        
* connect to ::1 port 8000 failed: Connection refused    
*   Trying 127.0.0.1...                                  
* Connected to localhost (127.0.0.1) port 8000 (#0)      
* Server auth using Basic with user 'd'                  
> GET /trs/api/intakes/ HTTP/1.1                         
> Authorization: Basic dXNlcjpwYXNz                              
> User-Agent: curl/7.38.0                                
> Host: localhost:8000                                   
> Accept: */*                                            
>                                                        
* HTTP 1.0, assume close after body                      
< HTTP/1.0 403 Forbidden                                 
< Vary: Cookie                                           
< X-Frame-Options: SAMEORIGIN                            
< Content-Type: application/json                         
< Connection: close                                      
< Server: Werkzeug/0.11.10 Python/3.4.2                  
< Date: Wed, 20 Jul 2016 14:16:32 GMT                    
<                                                        
* Closing connection 0                                   
{"message": "Not authenticated"}%                        

我看不出我哪里错了，也许有人可以帮助我？

Answer 1

Django 不本身支持基本 HTTP 身份验证，django.contrib.auth.backends.RemoteUserBackend 实际所做的在文档中有所描述。

通过此设置，RemoteUserMiddleware 将检测用户名 request.META['REMOTE_USER'] 并将验证并自动登录 使用 RemoteUserBackend 的用户。

REMOTE_USER 环境变量应该由位于 Django 前面的 Web 服务器设置（例如 apache）。

如果您只想支持 Authorization 标头，此自定义身份验证后端可能会有所帮助：https://www.djangosnippets.org/snippets/243/（来自 here）

Answer 2

import basicauth
from django.contrib.auth import authenticate

def api_list_things(request, intake_id=None):
    user_pass = basicauth.decode(request.META['HTTP_AUTHORIZATION'])
    if authenticate(username=user_pass[0], password=user_pass[1]):
        return JsonResponse({'message': 'Authenticated'}, status=200)
    return JsonResponse({'message': 'Not Authenticated'})