强制Django Channels Websocket身份验证

Question

The website I am working on requires login for every page by using a login required middleware.

I am trying to add websockets with Channels for two way communication to the client web browser for notifications.

Daphne is running as the interface server and manage.py runworker is running the workers.

I have a have a working function in the consumers.py file that runs when the connection has been opened.

The problem is that this connection can be opened, and the function runs by any web browser, without being logged in.

How can I force login before the connection can be opened?

Answer 1

If you want the user to be logged in for the page you can use the decorator login_required for your views. You first need to import it

from django.contrib.auth.decorators import login_required

and for the views you can then use it as any other normal decorator for example:-

@login_required
def my_view(request):
    ...

What this will do is it will ensure that the user is logged in before he is able to view the page.

This will take him to the login page if you have implemented your authentication back end and after he is logged in then redirect to the page in your view. If he is already logged in then he is allowed to access the page directly.

Answer 2

看到“ channels_api”库，他们做得很好。

Answer 3

You can use @channel_session_user_from_http for "websocket.connect" , @channel_session_user for "websocket.receive" .

You can got message.user from http session.

---

http://channels.readthedocs.io/en/stable/getting-started.html#authentication