我首先使用 python-eve 框架创建了一个 Web api,无需身份验证或用户帐户,效果非常好!我现在正在尝试添加身份验证和用户帐户,但遇到了一些困难。我想使用用户限制的资源访问,但是如果资源受到限制,用户如何创建新的用户帐户?我缺少什么?
我一直在努力遵循安心账户管理教程 http://python-eve.org/tutorials/account_management.html以及介绍认证与授权 http://python-eve.org/authentication.html#user-restricted-resource-access在 python-eve.org 上,我搜索了 stackoverflow,包括这个在这里回答 https://stackoverflow.com/questions/27029842/in-eve-how-can-you-store-the-users-password-securely.
这是我的实现:
run.py
import os.path
from eve import Eve
import my_auth
from flask.ext.bootstrap import Bootstrap
from eve_docs import eve_docs
app = Eve(auth=my_auth.BCryptAuth, settings = 'deployed_settings.py')
app.on_insert_accounts += my_auth.create_user
Bootstrap(app)
app.register_blueprint(eve_docs, url_prefix='/docs')
if __name__ == '__main__':
app.run()
my_auth.py
import bcrypt
from eve import Eve
from eve.auth import BasicAuth
class BCryptAuth(BasicAuth):
def check_auth(self, username, password, allowed_roles, resource, method):
# use Eve's own db driver; no additional connections/resources are used
accounts = Eve.app.data.driver.db['accounts']
account = accounts.find_one({'username': username})
if account and 'user_id' in account:
self.set_request_auth_value(account['user_id'])
return account and bcrypt.hashpw(
password.encode('utf-8'),account['salt'].encode('utf-8')) == account['password']
def create_user(documents):
for document in documents:
document['salt'] = bcrypt.gensalt().encode('utf-8')
password = document['password'].encode('utf-8')
document['password'] = bcrypt.hashpw(password, document['salt'])
部署设置.py
# We are running on a local machine, so just use the local mongod instance.
# Note that MONGO_HOST and MONGO_PORT could very well be left
# out as they already default to a bare bones local 'mongod' instance.
MONGO_HOST = 'localhost'
MONGO_PORT = 27017
MONGO_USERNAME = ''
MONGO_PASSWORD = ''
MONGO_DBNAME = 'practice'
# Name of the field used to store the owner of each document
AUTH_FIELD = 'user_id'
# Enable reads (GET), inserts (POST) and DELETE for resources/collections
# (if you omit this line, the API will default to ['GET'] and provide
# read-only access to the endpoint).
RESOURCE_METHODS = ['GET', 'POST', 'DELETE']
# Enable reads (GET), edits (PATCH), replacements (PUT) and deletes of
# individual items (defaults to read-only item access).
ITEM_METHODS = ['GET', 'PATCH', 'PUT', 'DELETE']
IF_MATCH = False # When set to false, older versions may potentially replace newer versions
XML = False # disable xml output
# Schemas for data objects are defined here:
classes = {
# ... Contents omitted for this question
}
people = {
# ... Contents omitted for this question
}
logs = {
# ... Contents omitted for this question
}
sessions = {
# ... Contents omitted for this question
}
accounts = {
# the standard account entry point is defined as '/accounts/<ObjectId>'.
# an additional read-only entry point is accessible at '/accounts/<username>'.
'additional_lookup': {
'url': 'regex("[\w]+")',
'field': 'username',
},
# disable endpoint caching to prevent apps from caching account data
'cache_control': '',
'cache_expires': 0,
# schema for the accounts endpoint
'schema': {
'username': {
'type': 'string',
'required': True,
'unique': True,
},
'password': {
'type': 'string',
'required': True,
},
},
}
# The DOMAIN dict explains which resources will be available and how they will
# be accessible to the API consumer.
DOMAIN = {
'classes': classes,
'people': people,
'logs': logs,
'sessions': sessions,
'accounts': accounts,
}