我正在尝试完成验证 Google 令牌的过程,以便在 Django 应用程序中访问用户的日历。尽管我遵循了网上找到的一些指示,但我的回调函数仍然收到 400 错误代码响应(错误请求)。
views.py
# -*- coding: utf-8 -*-
import os
import argparse
import httplib2
import logging
from apiclient.discovery import build
from oauth2client import tools
from oauth2client.django_orm import Storage
from oauth2client import xsrfutil
from oauth2client.client import flow_from_clientsecrets
from django.http import HttpResponse
from django.http import HttpResponseBadRequest
from django.http import HttpResponseRedirect
from django.shortcuts import render_to_response
from django.core.urlresolvers import reverse
from django.contrib import auth
from django.contrib.auth.decorators import login_required
from django.conf import settings
from apps.tecnico.models import Credentials, Flow
CLIENT_SECRETS = os.path.join(
os.path.dirname(__file__), '../../client_secrets.json')
@login_required
def index(request):
storage = Storage(Credentials, 'id', request.user, 'credential')
FLOW = flow_from_clientsecrets(
CLIENT_SECRETS,
scope='https://www.googleapis.com/auth/calendar.readonly',
redirect_uri='http://MY_URL:8000/oauth2/oauth2callback'
)
credential = storage.get()
if credential is None or credential.invalid is True:
FLOW.params['state'] = xsrfutil.generate_token(
settings.SECRET_KEY, request.user)
authorize_url = FLOW.step1_get_authorize_url()
f = Flow(id=request.user, flow=FLOW)
f.save()
return HttpResponseRedirect(authorize_url)
else:
http = httplib2.Http()
http = credential.authorize(http)
service = build(serviceName='calendar', version='v3', http=http,
developerKey='MY_DEV_KEY_FROM_GOOGLE_CONSOLE')
events = service.events().list(calendarId='primary').execute()
return render_to_response('calendario/welcome.html', {
'events': events['items'],
})
@login_required
def auth_return(request):
if not xsrfutil.validate_token(
settings.SECRET_KEY, request.REQUEST['state'], request.user):
return HttpResponseBadRequest()
storage = Storage(Credentials, 'id', request.user, 'credential')
FLOW = Flow.objects.get(id=request.user).flow
credential = FLOW.step2_exchange(request.REQUEST)
storage.put(credential)
return HttpResponseRedirect("http://MY_URL:8000/caly")
模型.py
from oauth2client.django_orm import FlowField, CredentialsField
[...]
class Credentials(models.Model):
id = models.ForeignKey(User, primary_key=True)
credential = CredentialsField()
class Flow(models.Model):
id = models.ForeignKey(User, primary_key=True)
flow = FlowField()
我已经下载了client_secrets.json直接从 Google Dev Console 获取文件。
开发控制台中指定的客户端ID类型是“Web应用程序”,我认为这是正确的。
我注意到的是,如果删除令牌验证代码块:
if not xsrfutil.validate_token(
settings.SECRET_KEY, request.REQUEST['state'], request.user):
return HttpResponseBadRequest()
一切正常,流程和凭证正确存储在数据库中,并且我可以读取日历。我可能做错了什么?
EDIT:我还检查了传出(至 Google)和传入(至回调)数据:
OUTGOING:
request.user:
admin
settings.SECRET_KEY:
I_AM_NOT_WRITING_IT_HERE
FLOW.params['state']:
SOME_OTHER_RANDOM_STUFF
INCOMING:
request.user:
admin
settings.SECRET_KEY:
I_AM_NOT_WRITING_IT_HERE
FLOW.params['state']:
SOME_OTHER_RANDOM_STUFF
数据是相同的,至少是相同的print来安慰。此外,通过控制台的生成/验证操作正常工作(xsrfutil.validate_token 返回 True,无论是测试数据还是真实数据,包括用户模型实例)。我更纳闷了。