0

今天我正在使用 python 和烧瓶创建一个小型 RESTfull 服务。看来，我似乎无法解决身份验证问题。

这是我的代码：

# Extensions
auth = HTTPBasicAuth()

def login_user(username,password):
    # If the username can be decoded as a JWT & the password is empty, return true
    if jwt.decode(username, SERVER_PAYLOARD_SECRET, algorithms=['HS256']) == '{"some":"payload"}' and password == "":
        return username and password
    else:
        # Otherwise, make the classic username/password verification
        # Get the password corresponding to the username.
        connection = sqlite3.connect(database_name)
        cursor = connection.cursor()
        cursor.execute("SELECT Username AND Password FROM Users WHERE Username = ?", (username))
        returned_data = cursor.fetchall()
        # Do the verification
        if returned_data[0] == username and pwd_context.verify(password,returned_data[1]):
            return username and password
        else:
            abort(401)

@auth.get_password
def verify_password(username,password):
    return login_user(username,password)
    # Look if the token used is in memory

@app.route('/api/user/delete_user', methods=['GET','POST'])
@auth.login_required
def delete_user():
    # Validate the login token, and then delete the user from the
    # database and all the streams or information he has.
    return "Hello World"

我不知道我可以返回什么，以及我的 login_user() 函数是否正确。

谢谢你的帮助，

干杯

编辑：当我运行代码时，我有这个错误：

    Traceback (most recent call last):
  [...]
  File "/home/n07070/FarDrive/Code/OpenPhotoStream/lib/python3.4/site-packages/flask_httpauth.py", line 57, in decorated
    password = self.get_password_callback(auth.username)
TypeError: verify_password() missing 1 required positional argument: 'password'
4

1 回答 1

1

小错误。改变这个：

@auth.get_password
def verify_password(username,password):
    return login_user(username,password)
    # Look if the token used is in memory

对此：

@auth.verify_password
def verify_password(username,password):
    return login_user(username,password)
    # Look if the token used is in memory

Flask-HTTPAuth 提供了几种不同的方法来验证客户端的凭据。这@auth.get_password是一个非常简单的方法，您的装饰函数采用用户名，您需要返回与该帐户对应的密码。这@auth.verify_password是一个更灵活的选项，它为您提供客户端提供的凭据，您可以实现自己的验证逻辑。听起来这最后一个选项就是你想要的。

于 2016-02-16T15:11:20.213 回答