简体繁体 English

如何在 Django 和 Drf 中使用 httponly cookie 实现令牌认证

[英]How to implement token authentication using httponly cookie in Django and Drf

原文 2020-12-27 16:41:21 1 1 django/ authentication/ django-rest-framework/ token

I'm building an application with django, Drf and currently using vanilla JS as Frontend for now.我正在使用 django、Drf 构建一个应用程序，并且目前使用 vanilla JS 作为前端。

I searched almost all through web on different use case for authentication on the web and I found out different links but these links seem to always favour the session authentication and token authentication.我几乎通过 web 搜索了 web 上不同用例的身份验证，我发现了不同的链接，但这些链接似乎总是倾向于 session 身份验证和身份验证。

Using Django helps us with the session authentication as default so I decided to study the auth process using a token auth.使用 Django 可以帮助我们默认使用 session 身份验证，因此我决定使用令牌身份验证来研究身份验证过程。

While doing this, I initially used the localstorage as a store for my tokens gotten from the backend response after user authenticates, But for some reasons which are valid, most devs/engineers advise against using the localstorage as it prones one to xss attacks..在执行此操作时，我最初使用 localstorage 作为我在用户身份验证后从后端响应中获得的令牌的存储，但是由于某些有效的原因，大多数开发人员/工程师建议不要使用 localstorage，因为它容易受到 xss 攻击。

So I decided to implement the httponly cookie method, but I haven't seen a practical use of this done on Django, I've seen theories on implementing all these but haven't seen someone done this..所以我决定实现 httponly cookie 方法，但我还没有看到在 Django 上实际使用这个方法，我已经看到了实现所有这些的理论，但还没有看到有人这样做..

Please how can I use the httponly cookie with my token stored as a cookie with DJANGO请我如何使用 httponly cookie 将我的令牌存储为带有 DJANGO 的 cookie

EDIT I know a httponly cookie does not allow JavaScript to access a cookie, so I decided to do this.编辑我知道 httponly cookie 不允许 JavaScript 访问 cookie，所以我决定这样做。

Django sends the cookie httponly with the token as the cookie Django 发送cookie httponly 以token 作为cookie
User makes a request to the backend用户向后端发出请求
server gets the token from the cookie sent as a request from the backend.服务器从作为后端请求发送的 cookie 中获取令牌。

4)"where the problem now comes" I can't set the token as an header in Django, I tried using the request.headers['Autho...] = Token.... But that doesn't allow item assignment.. So if my logic is correct this is where I'm stucked 4）“现在问题出在哪里”我无法在 Django 中将令牌设置为 header，我尝试使用 request.headers['Autho...] = Token.... 但这不允许项目分配..所以如果我的逻辑是正确的，这就是我被困的地方

EDIT So this time, I am now able to add a header from the server, using request.META to pass an Authorization key with the Token.... Value, that seems to work fine instead of having to use request.headers for passing an assignment..编辑所以这一次，我现在可以从服务器添加一个 header ，使用 request.META 传递一个带有令牌的授权密钥.... 值，这似乎工作正常，而不必使用 request.headers 传递一个任务。。

But something happened which shocked me, in as much as I'm able to change or add an authorization token from the server, the view still gives me an error, much like I never passed a token at all.....但是发生了让我震惊的事情，尽管我能够从服务器更改或添加授权令牌，但视图仍然给我一个错误，就像我根本没有传递令牌一样......

It's like after the whole efforts and everything nothing still changes, except if it's requested from the client side.就像在所有的努力之后，一切都没有改变，除非它是从客户端请求的。 Guess I will have to stick with localstorage for now, but still research more or wait for answers.我想我现在必须坚持使用本地存储，但仍需进行更多研究或等待答案。

1 个解决方案

I've done the Authentication with token using httponly cookie..我已经使用 httponly cookie 完成了使用令牌的身份验证..

I recalled when I asked questions and some loving guys from here helped tho, we couldn't see a straight off answer as we had to research and think as well...我记得当我问问题时，这里的一些有爱心的人提供了帮助，我们看不到直接的答案，因为我们还必须研究和思考......

The steps I used was this.我使用的步骤是这样的。

Django takes in user credentials Django 接收用户凭据
Django authenticate that credentials Django 验证该凭据
a token is exchanged for that data用令牌交换该数据
we set the token to a cookie using set_cookie(.... , httponly=True)我们使用 set_cookie(.... , httponly=True) 将令牌设置为 cookie

** Then it was now time for the real workout. ** 然后是时候进行真正的锻炼了。

I created a middleware which will be responsible for setting the token to an Authorization key in header dict.. instead of allowing the client to do this.我创建了一个中间件，它将负责将令牌设置为 header 字典中的授权密钥。而不是允许客户端执行此操作。 ---- The client couldn't handle this coz it was now a httponly flag which will prevent js from accessing it as the purpose of using httponly was for this to prevent xss attacks when tokens/cookies are normally stored in a browser storage ---- 客户端无法处理这个问题，因为它现在是一个 httponly 标志，它将阻止 js 访问它，因为使用 httponly 的目的是为了在令牌/cookies 通常存储在浏览器存储中时防止 xss 攻击
we then handle the middleware to our taste, as in mine I tried making sure it work for only some views and not all views (will be planning on making a custom decorator for it)然后我们根据自己的喜好处理中间件，就像在我的一样，我尝试确保它仅适用于某些视图而不是所有视图（将计划为其制作自定义装饰器）
then last was to we'll have fun and smile at seeing me create something as such without a previous tutorial...最后是看到我在没有以前的教程的情况下创建这样的东西时，我们会很开心和微笑......