Flask中的JWT认证构建安全的用户身份验证体系(1) - ToB企服应用市场:ToB评测及商务社交产业平台

# 用户数据库
users = {
'username': {'password': 'hashed\_password', 'email': 'user@example.com'}
}
# 注册路由
@app.route('/register', methods=['POST'])
def register():
data = request.get_json()
username = data.get('username')
password = data.get('password')
email = data.get('email')
if username in users:
return jsonify({'message': 'Username already exists!'}), 400
# 在实际应用中，密码应该进行哈希处理，以增加安全性
users[username] = {'password': password, 'email': email}
return jsonify({'message': 'User registered successfully!'}), 201

复制代码

# 令牌刷新路由
@app.route('/refresh\_token', methods=['POST'])
@token\_required
def refresh\_token():
token = request.args.get('token')
try:
data = jwt.decode(token, app.config['SECRET\_KEY'], algorithms=['HS256'], options={'verify\_exp': False})
new_token = jwt.encode({'username': data['username']}, app.config['SECRET\_KEY'])
return jsonify({'token': new_token.decode('UTF-8')})
except:
return jsonify({'message': 'Token is invalid!'}), 403

复制代码

import logging
# 设置日志记录级别
logging.basicConfig(level=logging.INFO)
# 登录路由
@app.route('/login')
def login():
auth = request.authorization
logging.info(f"Login attempt with username: {auth.username}")
if auth and auth.username in users and users[auth.username] == auth.password:
token = jwt.encode({'username': auth.username}, app.config['SECRET\_KEY'])
logging.info(f"Login successful for username: {auth.username}")
return jsonify({'token': token.decode('UTF-8')})
logging.info(f"Login failed for username: {auth.username}")
return jsonify({'message': 'Authentication failed!'}), 401

复制代码

from flask import Flask, request, jsonifyimport jwtimport loggingfrom functools import wrapsapp = Flask(__name__)app.config['SECRET\_KEY'] = 'your\_secret\_key'# 模拟用户数据库users = { 'username': {'password': 'hashed\_password', 'email': 'user@example.com'}}# 设置日志记录级别logging.basicConfig(level=logging.INFO)# 身份验证装饰器def token\_required(f): @wraps(f) def decorated(\*args, \*\*kwargs): token = request.args.get('token') if not token: return jsonify({'message': 'Token is missing!'}), 403 try: data = jwt.decode(token, app.config['SECRET\_KEY']) except: return jsonify({'message': 'Token is invalid!'}), 403 return f(\*args, \*\*kwargs) return decorated# 注册路由@app.route('/register', methods=['POST'])def register(): data = request.get_json() username = data.get('username') password = data.get('password') email = data.get('email') if username in users: return jsonify({'message': 'Username already exists!'}), 400 # 在现实应用中，密码应该举行哈希处理，以增加安全性 users[username] = {'password': password, 'email': email} return jsonify({'message': 'User registered successfully!'}), 201# 登录路由@app.route('/login')def login(): auth = request.authorization logging.info(f"Login attempt with username: {auth.username}") if auth and auth.username in users and users[auth.username]['password'] == auth.password: token = jwt.encode({'username': auth.username}, app.config['SECRET\_KEY']) logging.info(f"Login successful for username: {auth.username}") return jsonify({'token': token.decode('UTF-8')}) logging.info(f"Login failed for username: {auth.username}") return jsonify({'message': 'Authentication failed!'}), 401# 令牌刷新路由
@app.route('/refresh\_token', methods=['POST'])
@token\_required
def refresh\_token():
token = request.args.get('token')
try:
data = jwt.decode(token, app.config['SECRET\_KEY'], algorithms=['HS256'], options={'verify\_exp': False})
new_token = jwt.encode({'username': data['username']}, app.config['SECRET\_KEY'])
return jsonify({'token': new_token.decode('UTF-8')})
except:
return jsonify({'message': 'Token is invalid!'}), 403
# 受保护的路由@app.route('/protected')@token\_requireddef protected(): return jsonify({'message': 'Protected resource!'})if __name__ == '\_\_main\_\_': app.run()

复制代码

from flask import Flask, request, jsonify
import jwt
import logging
from functools import wraps
from OpenSSL import SSL
app = Flask(__name__)
app.config['SECRET\_KEY'] = 'your\_secret\_key'
# 模拟用户数据库
users = {
'username': {'password': 'hashed\_password', 'email': 'user@example.com'}
}
# 设置日志记录级别
logging.basicConfig(level=logging.INFO)
# 身份验证装饰器
def token\_required(f):
@wraps(f)
def decorated(\*args, \*\*kwargs):
token = request.args.get('token')
if not token:
return jsonify({'message': 'Token is missing!'}), 403
try:
data = jwt.decode(token, app.config['SECRET\_KEY'])
except:
return jsonify({'message': 'Token is invalid!'}), 403
return f(\*args, \*\*kwargs)
return decorated
# 注册路由、登录路由、令牌刷新路由和受保护的路由保持不变
if __name__ == '\_\_main\_\_':
context = ('cert.pem', 'key.pem') # 指定证书和密钥文件
app.run(host='0.0.0.0', port=443, ssl_context=context)

复制代码