用 Python 编写客户端以使用 JWT 身份验证调用休息 Web 服务

Question

I have setup a Django REST endpoint with JSON Web Tokens (JWT) Authentication, following all the steps explained in this article .

Briefly, the exposed endpoints are:

• http://localhost:8000/api/token/ # to get a new jwt token
• http://localhost:8000/api/token/refresh/ # to refresh a jwt token
• http://localhost:8000/hello/ # a sample web service which requires jwt authentication

The example explained in the article uses djangorestframework_simplejwt package, which uses settings.SECRET_KEY (of the Django web app) to encrypt the jwt tokens (using HS256 algorithm).

Also, server side, I have created a specific username ("testuser") with Django administration website to be used for JWT authorization.

Now, how can I start testing this REST web service which uses JWT authentication with a client written in Python?

Answer 1

To start testing the sample web service:

first, the client needs to get a new token, thus I introduce do_auth function, which returns a dictionary containing JWT 'access' and 'refresh' tokens:

import json
import requests

AUTH_API_ENDPOINT = "http://localhost:8000/api/token/"
REFRESH_TOKEN_API_ENDPOINT = "http://localhost:8000/api/token/refresh/"


def do_auth(username, password, url=AUTH_API_ENDPOINT) -> dict:
    data = {
        "username": username,
        "password": password
    }

    # sending post request and saving response as response object
    r = requests.post(url=url, data=data)

    # extracting response text
    response_text = r.text

    d = json.loads(response_text)

    return d

After successfully getting the 'access' and 'refresh' tokens (I need the correct credentials to do that ie I need to define a User in Django administration site), I can use the 'access' token to call the 'hello' end point:

def do_get(url, access_token: str):
    headers = {
        'Authorization': ('Bearer ' + access_token)
    }

    response = requests.get(url, headers=headers)

    return response

thus, to make a first call to the web service:

token_dict = do_auth("testuser", ...testuser password... )
# check response status code (should be 200 if successful)

# now I can call the endpoint
response = do_get('http://localhost:8000/hello', token_dict['access'])
# check response status code (should be 200 if successful)

print(response)
print(response.status_code) # error 401 : not authenticated

that's all to start testing the new web service.

JWT also provides for token refresh, so you will need also something like this:

def do_refresh(refresh_token, url=REFRESH_TOKEN_API_ENDPOINT):
    data = {
        'refresh': refresh_token
    }

    r = requests.post(url=url, data=data)

    d = json.loads(r.text)

    return d