如何使Django REST JWT身份验证与多个Web服务器进行比较？ [英] How to make Django REST JWT Authentication scale with mulitple webservers?
问题描述
然而，将来，这个解决方案将需要扩展。而不是单个服务器运行Django应用程序，我可以看到一个情况，当我需要多个Web服务器。当然，所有这些Web服务器都将连接到同一个数据库。但是，由于令牌不存储在数据库中，这将如何与多个Web服务器配合使用？一个服务器发出的令牌在其他服务器上不会生效。
那么其他人如何解决这个问题？
简而言之，你不需要担心使用JWT扩展
详细说明：
首先让我们了解Django-Rest-Framework（DRF）提供的默认令牌认证与DRF-JWT提供的令牌之间的实现差异。
DRF提供的令牌
rest_framework.authentication.TokenAuthentication
令牌创建：
1）创建令牌
Token.objects.create（user = user）
2）将在step1创建的令牌存储在数据库
3）将令牌返回给客户端
令牌身份验证： p>
1）检查数据库中是否存在客户端传递的令牌
2）如果令牌存在，这意味着用户被认证
DRF-JWT提供的令牌
rest_framework_jwt.authentication.JSONWebTokenAuthentication
令牌创建：
1）创建令牌
body = base64encode（header）+。 + base64encode（payload）
签名= HMACSHA256_encode（body，'secret_key'） #secret key通常在您的设置中指定.py
token = body +。 +签名
2）将令牌返回给客户端
令牌认证：
1）解码令牌
token_segment = token.split（'。'）
body = token_segment [0] +。 + token_segment [1]
签名= token_segment [2]
decode_body = HMACSHA256_decode（signature，'secret_key'）
2）如果decode_body等于body，则验证用户
结论
从上述机制，我们可以肯定地得出结论，JWT方法更多可扩展，因为它仅仅依赖于secret_key，并且每个网络服务器应该具有settings.py下的secret_key
所以为了回答你的问题，你不需要担心扩展它：）
I currently have a Django app that is simply a bunch of REST APIs (backed by a database of course). I am managing my authentications with Django REST framework JWT. It's working fine. Whenever a user logs in, one of my API returns a token that the consuming application stores for later usage. So far so good.
However, in the future, this solution will need to scale. And instead of having a single server running the Django app, I can forsee a situation when I will need multiple Webservers. Of course all those webservers will be connected to the same Database. But since the token is not stored in the Database, how will this work with mulitple web servers? A token issued by one server won't be valid on another.
So how have other people solved this problem??
In short you do NOT need to worry about scaling with JWT
Detail explanation:
First let's understand the implementation difference between the default token authentication provided by Django-Rest-Framework(DRF) and the token provided by DRF-JWT
Token provided by DRF
rest_framework.authentication.TokenAuthentication
Token creation:
1) Create token
Token.objects.create(user=user)
2) Store the token created at step1 at the database
3) Return the token to the client
Token authentication:
1)Check if the token pass by the client exist in the database
2)If the token exist, this means that the user is authenticated
Token provided by DRF-JWT
rest_framework_jwt.authentication.JSONWebTokenAuthentication
Token creation:
1) Create token
body = base64encode(header) + "." + base64encode(payload)
signature = HMACSHA256_encode(body, 'secret_key') #secret key is usually specify in your settings.py
token = body + "." + signature
2) Return the token to the client
Token authentication:
1)Decode the token
token_segment = token.split('.')
body = token_segment[0] + "." + token_segment[1]
signature = token_segment[2]
decode_body = HMACSHA256_decode(signature, 'secret_key')
2)If decode_body is equal to body, the user is authenticated
Conclusion
From the mechanism above, we can safely conclude that the JWT approach is more scalable because it just depends solely on secret_key, and every webserver should have the secret_key under settings.py
So to answer your question, you do not need to worry about scaling it :)
这篇关于如何使Django REST JWT身份验证与多个Web服务器进行比较？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
