python - 如何使用自定义权限类发送 401 错误代码而不是 403？

Question

我正在使用自定义身份验证方案，但我不知道如何让它发送 401 HTTP 响应而不是 403。指南位于 http://www.django-rest-framework.org/api-guide/authentication/#custom-authentication说要覆盖 authenticate_header 方法，但这似乎没有做任何事情。发送 403 的部分是引发 AuthenticationFailed 异常的地方。我通过 permission_classes 属性将 OwnerCredentialsFound 分配给了 ModelViewSet。

from rest_framework import exceptions
from rest_framework import permissions
from django.contrib.auth.models import User

def authenticateUser(username, password):
    try:
        user = User.objects.get(username=username)
        return user.check_password(password)
    except:
        return False



class OwnerCredentialsFound(permissions.IsAuthenticated):

    def has_permission(self, request, view):
        #Check credentials
        #If the fields don't exist, the given default value is used
        username = request.POST.get('username', None)
        password = request.POST.get('password', None)
        authenticated = authenticateUser(username, password)
        if(not authenticated and username is not None and password is not None):
            raise exceptions.AuthenticationFailed('Username/password pair not found')
        elif(not authenticated):
            authenticated = permissions.IsAuthenticated.has_permission(self, request, view)
        else:
            #set the user
            view.request.user = User.objects.get(username=username)
        return authenticated

    def authenticate_header(self, request):
        return '{"username" : <username>, "password" : <password>}'

更新:我似乎混淆了身份验证和权限类。我正在使用权限类，但它是具有名为 authenticate_header 的方法的身份验证类。

Answer 1

基本上，我并没有真正理解权限和身份验证之间的区别，因此导致了混淆。权限类没有 authenticate_header 方法，但身份验证类有。这是我为解决问题所做的工作:

from rest_framework import exceptions
from rest_framework import authentication
from django.contrib.auth.models import User

def authenticateUser(username, password):
    try:
        user = User.objects.get(username=username)
        return user.check_password(password)
    except:
        return False

class CustomAuthentication(authentication.BaseAuthentication):
    def authenticate(self, request):
        username = request.POST.get('username', None)
        password = request.POST.get('password', None)
        authenticated = authenticateUser(username, password)
        if(not authenticated and username is not None and password is not None):
            #authentication attempted and failed
            raise exceptions.AuthenticationFailed('Username/password pair not found')
        elif(not authenticated):
            #authentication not attempted (try other authentications)
            return None
        else:
            #authentication attempted and suceeded
            return (User.objects.get(username=username), None)


    def authenticate_header(self, request):
        return '{"username" : <username>, "password" : <password>}'

在我看来:

permission_classes = (IsAuthenticated,)
authentication_classes = (CustomAuthentication, SessionAuthentication)

这种权限和身份验证的混淆也解释了为什么我尝试组合多个权限类失败了(您可能会在我的原始代码中注意到我从权限类继承并调用它的 has_permission 方法来解决这个问题)。我不再需要自定义权限类，因为我可以只使用两个身份验证类。