TokenAuthentication: Allow custom keyword in the header (#4097)

This allows subclassing TokenAuthentication and setting custom keyword,
thus allowing the Authorization header to be for example:

    Bearer 956e252a-513c-48c5-92dd-bfddc364e812

It doesn't change the behavior of TokenAuthentication itself,
it simply allows to reuse the logic of TokenAuthentication without
the need of copy pasting the class and changing one hardcoded string.

Related: #4080
This commit is contained in:
Miro Hrončok 2016-05-04 11:53:34 +02:00 committed by Tom Christie
parent 37b1ce5d86
commit ffdac0d936
3 changed files with 22 additions and 7 deletions

View File

@ -143,6 +143,8 @@ For clients to authenticate, the token key should be included in the `Authorizat
Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b
**Note:** If you want to use a different keyword in the header, such as `Bearer`, simply subclass `TokenAuthentication` and set the `keyword` class variable.
If successfully authenticated, `TokenAuthentication` provides the following credentials.
* `request.user` will be a Django `User` instance.

View File

@ -150,6 +150,7 @@ class TokenAuthentication(BaseAuthentication):
Authorization: Token 401f7ac837da42b97f613d789819ff93537bee6a
"""
keyword = 'Token'
model = None
def get_model(self):
@ -168,7 +169,7 @@ class TokenAuthentication(BaseAuthentication):
def authenticate(self, request):
auth = get_authorization_header(request).split()
if not auth or auth[0].lower() != b'token':
if not auth or auth[0].lower() != self.keyword.lower().encode():
return None
if len(auth) == 1:
@ -199,4 +200,4 @@ class TokenAuthentication(BaseAuthentication):
return (token.user, token)
def authenticate_header(self, request):
return 'Token'
return self.keyword

View File

@ -35,6 +35,10 @@ class CustomTokenAuthentication(TokenAuthentication):
model = CustomToken
class CustomKeywordTokenAuthentication(TokenAuthentication):
keyword = 'Bearer'
class MockView(APIView):
permission_classes = (permissions.IsAuthenticated,)
@ -53,6 +57,7 @@ urlpatterns = [
url(r'^basic/$', MockView.as_view(authentication_classes=[BasicAuthentication])),
url(r'^token/$', MockView.as_view(authentication_classes=[TokenAuthentication])),
url(r'^customtoken/$', MockView.as_view(authentication_classes=[CustomTokenAuthentication])),
url(r'^customkeywordtoken/$', MockView.as_view(authentication_classes=[CustomKeywordTokenAuthentication])),
url(r'^auth-token/$', 'rest_framework.authtoken.views.obtain_auth_token'),
url(r'^auth/', include('rest_framework.urls', namespace='rest_framework')),
]
@ -166,6 +171,7 @@ class BaseTokenAuthTests(object):
urls = 'tests.test_authentication'
model = None
path = None
header_prefix = 'Token '
def setUp(self):
self.csrf_client = APIClient(enforce_csrf_checks=True)
@ -179,31 +185,31 @@ class BaseTokenAuthTests(object):
def test_post_form_passing_token_auth(self):
"""Ensure POSTing json over token auth with correct credentials passes and does not require CSRF"""
auth = 'Token ' + self.key
auth = self.header_prefix + self.key
response = self.csrf_client.post(self.path, {'example': 'example'}, HTTP_AUTHORIZATION=auth)
self.assertEqual(response.status_code, status.HTTP_200_OK)
def test_fail_post_form_passing_nonexistent_token_auth(self):
# use a nonexistent token key
auth = 'Token wxyz6789'
auth = self.header_prefix + 'wxyz6789'
response = self.csrf_client.post(self.path, {'example': 'example'}, HTTP_AUTHORIZATION=auth)
self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
def test_fail_post_form_passing_invalid_token_auth(self):
# add an 'invalid' unicode character
auth = 'Token ' + self.key + "¸"
auth = self.header_prefix + self.key + "¸"
response = self.csrf_client.post(self.path, {'example': 'example'}, HTTP_AUTHORIZATION=auth)
self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
def test_post_json_passing_token_auth(self):
"""Ensure POSTing form over token auth with correct credentials passes and does not require CSRF"""
auth = "Token " + self.key
auth = self.header_prefix + self.key
response = self.csrf_client.post(self.path, {'example': 'example'}, format='json', HTTP_AUTHORIZATION=auth)
self.assertEqual(response.status_code, status.HTTP_200_OK)
def test_post_json_makes_one_db_query(self):
"""Ensure that authenticating a user using a token performs only one DB query"""
auth = "Token " + self.key
auth = self.header_prefix + self.key
def func_to_test():
return self.csrf_client.post(self.path, {'example': 'example'}, format='json', HTTP_AUTHORIZATION=auth)
@ -273,6 +279,12 @@ class CustomTokenAuthTests(BaseTokenAuthTests, TestCase):
path = '/customtoken/'
class CustomKeywordTokenAuthTests(BaseTokenAuthTests, TestCase):
model = Token
path = '/customkeywordtoken/'
header_prefix = 'Bearer '
class IncorrectCredentialsTests(TestCase):
def test_incorrect_credentials(self):
"""