Python API认证与授权实战：从Basic Auth到OAuth2.0

最新推荐文章于 2026-06-21 19:50:00 发布

原创最新推荐文章于 2026-06-21 19:50:00 发布 · 261 阅读

5 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

标签

#rust #github #python

开发板推荐：天空星STM32F407VET6开发板

超高性价比 STM32主控 | 超高主频 | 一板兼容百芯 | 比赛神器 | 沉金彩色丝印

点击查看

Python API认证与授权实战：从Basic Auth到OAuth2.0

引言

API安全是后端开发中至关重要的一环。作为从Python转向Rust的后端开发者，我深刻体会到认证与授权机制的重要性。一个安全可靠的API需要完善的认证体系来保护敏感数据和资源。本文将从实战角度出发，深入探讨Python API认证与授权的各种方案，帮助你构建安全的后端服务。

一、认证与授权概述

1.1 基本概念

认证(Authentication)：验证用户身份，确认"你是谁"
授权(Authorization)：决定用户能访问什么资源，确认"你能做什么"
会话管理：跟踪用户登录状态

1.2 常见认证方案对比

方案	安全性	复杂度	适用场景
Basic Auth	低	低	内部工具、开发环境
API Key	中	低	服务器间通信
JWT	高	中	现代Web应用
OAuth2.0	高	高	第三方登录、开放平台
Session-Cookie	中	中	传统Web应用

二、Basic Authentication

2.1 原理

Basic Auth是最简单的认证方式，通过在请求头中发送Base64编码的用户名和密码：

Authorization: Basic base64(username:password)

2.2 Flask实现

from flask import Flask, request, jsonify
from base64 import b64decode

app = Flask(__name__)

def check_auth(username, password):
    return username == 'admin' and password == 'secret'

def authenticate():
    return jsonify({'error': 'Unauthorized'}), 401, {
        'WWW-Authenticate': 'Basic realm="Login Required"'
    }

@app.route('/protected')
def protected():
    auth = request.headers.get('Authorization')
    if not auth or not auth.startswith('Basic '):
        return authenticate()
    
    encoded = auth.split(' ')[1]
    decoded = b64decode(encoded).decode('utf-8')
    username, password = decoded.split(':')
    
    if check_auth(username, password):
        return jsonify({'message': 'Welcome!'})
    return authenticate()

if __name__ == '__main__':
    app.run()

三、API Key认证

3.1 设计思路

API Key适合服务器间通信，通过在请求头或URL参数中传递密钥：

from fastapi import FastAPI, Header, HTTPException

app = FastAPI()

API_KEYS = {'valid_api_key_123': 'user1', 'valid_api_key_456': 'user2'}

async def get_api_key(x_api_key: str = Header(None)):
    if x_api_key not in API_KEYS:
        raise HTTPException(status_code=401, detail="Invalid API Key")
    return API_KEYS[x_api_key]

@app.get('/api/data')
async def get_data(api_key: str = Depends(get_api_key)):
    return {'data': 'sensitive information', 'user': api_key}

3.2 安全建议

使用HTTPS传输API Key
定期轮换API Key
限制API Key的使用范围

四、JWT认证

4.1 JWT结构

JWT由三部分组成，用点号分隔：

Header：声明类型和算法
Payload：包含用户信息和声明
Signature：用于验证完整性

4.2 PyJWT实现

import jwt
from datetime import datetime, timedelta
from fastapi import FastAPI, Depends, HTTPException
from pydantic import BaseModel

app = FastAPI()

SECRET_KEY = 'your-secret-key-here'
ALGORITHM = 'HS256'
ACCESS_TOKEN_EXPIRE_MINUTES = 30

class Token(BaseModel):
    access_token: str
    token_type: str

class User(BaseModel):
    username: str
    password: str

def create_access_token(data: dict):
    to_encode = data.copy()
    expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
    to_encode.update({'exp': expire})
    encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
    return encoded_jwt

@app.post('/token', response_model=Token)
async def login(form_data: User):
    if form_data.username != 'admin' or form_data.password != 'secret':
        raise HTTPException(status_code=401, detail="Invalid credentials")
    
    access_token = create_access_token(data={'sub': form_data.username})
    return {'access_token': access_token, 'token_type': 'bearer'}

@app.get('/protected')
async def protected(token: str = Depends(get_token)):
    return {'message': 'Welcome!'}

4.3 Token验证中间件

from fastapi import Request, HTTPException
from starlette.middleware.base import BaseHTTPMiddleware

class AuthMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request: Request, call_next):
        if request.url.path == '/token':
            return await call_next(request)
        
        auth_header = request.headers.get('Authorization')
        if not auth_header or not auth_header.startswith('Bearer '):
            raise HTTPException(status_code=401, detail="Token missing")
        
        token = auth_header.split(' ')[1]
        try:
            payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
            request.state.user = payload.get('sub')
        except jwt.PyJWTError:
            raise HTTPException(status_code=401, detail="Invalid token")
        
        return await call_next(request)

五、OAuth2.0认证

5.1 OAuth2.0流程

用户 → 授权请求 → 授权服务器 → 授权码 → 令牌请求 → 访问令牌 → 资源服务器

5.2 使用Authlib实现

from flask import Flask, redirect, url_for, session
from authlib.integrations.flask_client import OAuth

app = Flask(__name__)
app.secret_key = 'your-secret-key'

oauth = OAuth(app)

github = oauth.register(
    name='github',
    client_id='your-client-id',
    client_secret='your-client-secret',
    access_token_url='https://github.com/login/oauth/access_token',
    authorize_url='https://github.com/login/oauth/authorize',
    api_base_url='https://api.github.com/',
    client_kwargs={'scope': 'user:email'}
)

@app.route('/login')
def login():
    redirect_uri = url_for('authorize', _external=True)
    return github.authorize_redirect(redirect_uri)

@app.route('/authorize')
def authorize():
    token = github.authorize_access_token()
    resp = github.get('user', token=token)
    user_info = resp.json()
    session['user'] = user_info
    return redirect('/profile')

@app.route('/profile')
def profile():
    user = session.get('user')
    if not user:
        return redirect('/login')
    return f"Hello {user['login']}!"

六、权限控制

6.1 基于角色的访问控制(RBAC)

from enum import Enum

class Role(str, Enum):
    ADMIN = 'admin'
    USER = 'user'
    GUEST = 'guest'

class User(BaseModel):
    username: str
    role: Role

def require_role(required_role: Role):
    def decorator(func):
        async def wrapper(*args, **kwargs):
            user = kwargs.get('user')
            if not user or user.role < required_role:
                raise HTTPException(status_code=403, detail="Insufficient permissions")
            return await func(*args, **kwargs)
        return wrapper
    return decorator

@app.get('/admin')
@require_role(Role.ADMIN)
async def admin_panel(user: User = Depends(get_current_user)):
    return {'message': 'Admin panel'}

6.2 基于资源的访问控制

async def check_resource_access(user_id: str, resource_id: str) -> bool:
    # 检查用户是否有权访问该资源
    return True

@app.get('/resources/{resource_id}')
async def get_resource(
    resource_id: str,
    user: User = Depends(get_current_user)
):
    if not await check_resource_access(user.id, resource_id):
        raise HTTPException(status_code=403, detail="Access denied")
    return {'resource': 'data'}

七、实战：完整认证系统

7.1 用户模型

from sqlalchemy import Column, String, Boolean
from sqlalchemy.ext.declarative import declarative_base
from passlib.context import CryptContext

Base = declarative_base()
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

class User(Base):
    __tablename__ = 'users'
    
    id = Column(String, primary_key=True)
    username = Column(String, unique=True, index=True)
    email = Column(String, unique=True, index=True)
    hashed_password = Column(String)
    is_active = Column(Boolean, default=True)
    
    def verify_password(self, password: str) -> bool:
        return pwd_context.verify(password, self.hashed_password)
    
    def create_access_token(self) -> str:
        return create_access_token(data={'sub': self.username})

7.2 注册与登录

class UserCreate(BaseModel):
    username: str
    email: str
    password: str

@app.post('/register')
async def register(user: UserCreate, db: Session = Depends(get_db)):
    db_user = db.query(User).filter(User.email == user.email).first()
    if db_user:
        raise HTTPException(status_code=400, detail="Email already registered")
    
    hashed_password = pwd_context.hash(user.password)
    new_user = User(
        id=str(uuid.uuid4()),
        username=user.username,
        email=user.email,
        hashed_password=hashed_password
    )
    
    db.add(new_user)
    db.commit()
    db.refresh(new_user)
    
    return {'message': 'User created successfully'}