Web服务请求身份验证django token-api

Question

I want to implement a web service for an iOS application in django. I need some kind of authentication, and I googled and heard good things about django token-api.

The only thing I don't understand, is how I make sure one authenticated user can not perform actions for another.

For example, If i have a view that has the @token-required, that only promises that a valid token has been sent, however someone can just change the PK in the request itself and make changes for another user.

How do I make sure the user who has the token, can only perform actions for himself?

Answer 1

On a very broad level, you need to distinguish between authentication and authorization . You can read this page as an example, or google it for more, but the basic distinction is that authentication determines that a user is who he says he is, while authorization determines what a certain user is able to see or do.

As you noted above, you can use the django-token-api to help with the authentication issue. But once you've determined that, you need to move to authorization . This is more an issue of permissions that you can see on a per-user (or per-group) basis for individual objects, views, etc.

As Ambroise noted in the comments, using an API framework can make this easier. Here is the django-rest-framework documentation for setting permissions once you have authenticated the user.