-
-
Notifications
You must be signed in to change notification settings - Fork 6.9k
Update authentication.py Code Simplification #9502
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -150,10 +150,10 @@ def dummy_get_response(request): # pragma: no cover | |
|
||
class TokenAuthentication(BaseAuthentication): | ||
""" | ||
Simple token based authentication. | ||
Simple token-based authentication. | ||
|
||
Clients should authenticate by passing the token key in the "Authorization" | ||
HTTP header, prepended with the string "Token ". For example: | ||
HTTP header, prepended with the string "Token ". For example: | ||
|
||
Authorization: Token 401f7ac837da42b97f613d789819ff93537bee6a | ||
""" | ||
|
@@ -167,31 +167,19 @@ def get_model(self): | |
from rest_framework.authtoken.models import Token | ||
return Token | ||
|
||
""" | ||
A custom token model may be used, but must have the following properties. | ||
|
||
* key -- The string identifying the token | ||
* user -- The user to which the token belongs | ||
""" | ||
|
||
def authenticate(self, request): | ||
auth = get_authorization_header(request).split() | ||
|
||
if not auth or auth[0].lower() != self.keyword.lower().encode(): | ||
if len(auth) != 2 or auth[0].lower() != self.keyword.lower().encode(): | ||
return None | ||
|
||
if len(auth) == 1: | ||
msg = _('Invalid token header. No credentials provided.') | ||
raise exceptions.AuthenticationFailed(msg) | ||
elif len(auth) > 2: | ||
msg = _('Invalid token header. Token string should not contain spaces.') | ||
raise exceptions.AuthenticationFailed(msg) | ||
Comment on lines
-183
to
-188
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. What happened to these error messages? The idea is to validate the shape of the token header; with your proposed code, an invalid token will go unnoticed. |
||
|
||
|
||
token = auth[1] | ||
try: | ||
token = auth[1].decode() | ||
token = token.decode() | ||
except UnicodeError: | ||
msg = _('Invalid token header. Token string should not contain invalid characters.') | ||
raise exceptions.AuthenticationFailed(msg) | ||
raise exceptions.AuthenticationFailed( | ||
_('Invalid token header. Token string should not contain invalid characters.') | ||
) | ||
Comment on lines
-193
to
+182
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Why is this change necessary? |
||
|
||
return self.authenticate_credentials(token) | ||
|
||
|
@@ -205,7 +193,7 @@ def authenticate_credentials(self, key): | |
if not token.user.is_active: | ||
raise exceptions.AuthenticationFailed(_('User inactive or deleted.')) | ||
|
||
return (token.user, token) | ||
return token.user, token | ||
|
||
def authenticate_header(self, request): | ||
return self.keyword | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why would this need to be removed?