[英]Django's user_passes_test always gets Anonymous User
I'm using the following class-based view and applying the UserPassesTestMixin to it to check some pre-conditions.我正在使用以下基于类的视图并将UserPassesTestMixin应用到它以检查一些先决条件。
class SomeTestView(UserPassesTestMixin, APIView):
def test_func(self):
return check_precondition(self.request.user)
def get(self, request):
print("inside view")
print("user: ", request.user)
print("is_authenticated? ", request.user.is_authenticated)
return Response({"status": "success"})
Below is my precondition:以下是我的先决条件:
def check_precondition(user):
print("in user_passes_test")
print("user: ", user)
print("is_authenticated? ", user.is_authenticated)
return True
Here's the output I am getting:这是我得到的 output:
in user_passes_test
user: AnonymousUser
is_authenticated? False
inside view
user: John Doe/john@test.domain
is_authenticated? True
What I'm not able to understand is that why is the request.user
anonymous inside the user_passes_test
check.我无法理解的是,为什么
request.user
在user_passes_test
检查中是匿名的。 I want to run some precondition checks based on the user object.我想根据用户 object 运行一些前置条件检查。
Here is my sequence of middlewares:这是我的中间件序列:
MIDDLEWARE = [
'corsheaders.middleware.CorsMiddleware',
'django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
]
I'm on Django 3.1.7
and djangorestframework 3.12.3
.我在 Django
3.1.7
和 djangorestframework 3.12.3
上。
What I'm not able to understand is that why is the
request.user
anonymous inside theuser_passes_test
check.我无法理解的是,为什么
request.user
在user_passes_test
检查中是匿名的。
The UserPassesTestMixin
does not check if the user has logged in. Sometimes you might want to check a property that can be True
for non-authenticated users. UserPassesTestMixin
不检查用户是否已登录。有时您可能想要检查一个属性,该属性对于未经身份验证的用户可能为True
。 For example a view that should only be visible to non-superusers, or to a user that has not registered (yet), but is based on some session variables.例如,仅对非超级用户或尚未注册(尚未)的用户可见但基于某些 session 变量的视图。
You can add an extra check with the LoginRequiredMixin
mixin [Django-doc] .您可以使用
LoginRequiredMixin
mixin [Django-doc]添加额外的检查。 But the way the Django REST framework handles this is normally with permission_classes
[DRF-doc] :但是 Django REST 框架处理这个问题的方式通常是使用
permission_classes
[DRF-doc] :
from rest_framework import permissions
from rest_framework.permissions import IsAuthenticated
class UserPassesSomeTest(permissions.BasePermission):
message = 'Some custom message'
def has_permission(self, request, view):
user = request.user
print("in user_passes_test")
print("user: ", user)
print("is_authenticated? ", user.is_authenticated)
return True
class home(APIView):
permission_classes = (IsAuthenticated, UserPassesSomeTest)
# …
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.