I ved Creat this Django & React Project ( https://github.com/axilaris/docker-django-react-celery-redis); I m在接触Authentication方面的困难。 你们可以很容易地测试和脱离我的法典:
- docker-compose build
- docker-compose up
我在进入用户/用户时不断获得准入问题(可以登记、登录)
backend_container | Forbidden: /api/user
backend_container | WARNING:django.request:Forbidden: /api/user
You can look more the logs here: https://gist.github.com/axilaris/7b7a5c50f4f7112b440eaf8ef8100d9d In my django api code (backend/user_api/views.py):
class UserView(APIView):
permission_classes = (permissions.IsAuthenticated,)
authentication_classes = (SessionAuthentication,)
def get(self, request):
serializer = UserSerializer(request.user)
return Response({ user : serializer.data}, status=status.HTTP_200_OK)
In settings.py:
CORS_ALLOWED_ORIGINS = [
http://localhost ,
http://127.0.0.1 ,
http://0.0.0.0 ,
]
CORS_ALLOW_CREDENTIALS = True
INSTALLED_APPS = [
..
corsheaders ,
]
MIDDLEWARE = [
corsheaders.middleware.CorsMiddleware ,
...
]
反应:
axios.defaults.xsrfCookieName = csrftoken ;
axios.defaults.xsrfHeaderName = X-CSRFToken ;
axios.defaults.withCredentials = true;
useEffect(() => {
client.get("/api/user")
.then(function(res) {
setCurrentUser(true);
})
.catch(function(error) {
setCurrentUser(false);
});
}, []);
这里是我的网络标志:https://gist.github.com/axilaris/f5076f8a1e009d77df78de562259427e 。
/api/login确实提供了 c和 session。 但是,这一 co子在(api/user)中没有使用。
因此,每当Ilogin和I在浏览器上重载回当地东道方之后,它就禁止(api/user)进入日志。 我感到,索马里再次解放联盟的成立是正确的,其全权证书在背后和前身都是真实的。
UPDATE from ChatGPT (questing how to make it work when with HttpOnly):
If you can t access the session cookie from the client-side, it s probably because the cookie has the HttpOnly flag set. This is a security feature that prevents JavaScript from accessing the cookie, helping mitigate cross-site scripting attacks.