戰(zhàn) Day 3：FastAPI用戶注冊(cè)、密碼加密與JWT登錄認(rèn)證)
Python全棧實(shí)戰(zhàn) Day 3用戶注冊(cè)與JWT登錄認(rèn)證前言這是“10天Python全棧項(xiàng)目實(shí)戰(zhàn)”系列的第3篇。前兩天已經(jīng)完成FastAPI與Vue3項(xiàng)目搭建第一個(gè)前后端接口調(diào)用MySQL數(shù)據(jù)庫(kù)連接SQLAlchemy用戶模型創(chuàng)建。今天將在現(xiàn)有項(xiàng)目中實(shí)現(xiàn)完整的后端用戶認(rèn)證流程用戶注冊(cè)密碼哈希用戶登錄生成JWT Token根據(jù)Token獲取當(dāng)前用戶。注意數(shù)據(jù)庫(kù)中不能直接保存用戶明文密碼只保存經(jīng)過密碼哈希算法處理后的結(jié)果。一、安裝認(rèn)證依賴進(jìn)入后端項(xiàng)目目錄并激活虛擬環(huán)境cd backend .venv\Scripts\activate安裝依賴pip install pyjwt pwdlib[argon2] python-dotenv email-validator各依賴的作用依賴作用PyJWT生成和解析JWTpwdlib密碼哈希與校驗(yàn)argon2實(shí)際使用的密碼哈希算法python-dotenv讀取環(huán)境變量email-validator校驗(yàn)郵箱格式FastAPI當(dāng)前官方JWT教程使用PyJWT處理Token并使用pwdlib處理密碼。PasswordHash.recommended()目前默認(rèn)選擇Argon2。更新依賴文件pip freeze requirements.txt二、調(diào)整項(xiàng)目結(jié)構(gòu)本文按照以下后端結(jié)構(gòu)編寫backend ├── app │ ├── api │ │ ├── __init__.py │ │ └── auth.py │ ├── core │ │ ├── __init__.py │ │ └── security.py │ ├── models │ │ ├── __init__.py │ │ └── user.py │ ├── schemas │ │ ├── __init__.py │ │ └── user.py │ ├── __init__.py │ ├── database.py │ └── main.py ├── .env ├── .gitignore └── requirements.txtdatabase.py和models/user.py應(yīng)該已經(jīng)在Day 2中創(chuàng)建。三、檢查用戶數(shù)據(jù)模型打開app/models/user.py確認(rèn)用戶表至少包含以下字段from datetime import datetime from sqlalchemy import Boolean, DateTime, String, func from sqlalchemy.orm import Mapped, mapped_column from app.database import Base class User(Base): __tablename__ users id: Mapped[int] mapped_column( primary_keyTrue, indexTrue, ) username: Mapped[str] mapped_column( String(30), uniqueTrue, indexTrue, nullableFalse, ) email: Mapped[str] mapped_column( String(100), uniqueTrue, indexTrue, nullableFalse, ) hashed_password: Mapped[str] mapped_column( String(255), nullableFalse, ) is_active: Mapped[bool] mapped_column( Boolean, defaultTrue, nullableFalse, ) created_at: Mapped[datetime] mapped_column( DateTime, server_defaultfunc.now(), nullableFalse, )這里保存的是hashed_password而不是password如果Day 2創(chuàng)建的表沒有hashed_password字段需要修改數(shù)據(jù)模型和數(shù)據(jù)庫(kù)表。開發(fā)階段沒有重要數(shù)據(jù)時(shí)可以刪除舊表后重新創(chuàng)建已有數(shù)據(jù)時(shí)應(yīng)使用數(shù)據(jù)庫(kù)遷移或執(zhí)行對(duì)應(yīng)的ALTER TABLE語句不能直接刪表。四、創(chuàng)建請(qǐng)求和響應(yīng)模型創(chuàng)建app/schemas/user.py寫入from pydantic import BaseModel, ConfigDict, EmailStr, Field class UserRegister(BaseModel): username: str Field( min_length3, max_length30, patternr^[a-zA-Z0-9_]$, ) email: EmailStr password: str Field( min_length8, max_length128, ) class UserLogin(BaseModel): username: str password: str class TokenResponse(BaseModel): access_token: str token_type: str bearer class UserResponse(BaseModel): id: int username: str email: EmailStr is_active: bool model_config ConfigDict(from_attributesTrue)這幾個(gè)模型分別負(fù)責(zé)UserRegister校驗(yàn)注冊(cè)參數(shù)UserLogin校驗(yàn)登錄參數(shù)TokenResponse定義登錄成功的返回內(nèi)容UserResponse定義返回給前端的用戶信息。不要把hashed_password放進(jìn)UserResponse否則可能將密碼哈希結(jié)果返回給前端。五、配置JWT密鑰在項(xiàng)目根目錄創(chuàng)建.env先生成隨機(jī)密鑰python -c import secrets; print(secrets.token_hex(32))終端會(huì)輸出一段隨機(jī)字符串將它復(fù)制進(jìn).envSECRET_KEY替換成剛才生成的隨機(jī)字符串 ACCESS_TOKEN_EXPIRE_MINUTES30創(chuàng)建或檢查.gitignore.venv/ __pycache__/ *.pyc .env.env中包含JWT簽名密鑰不應(yīng)該提交到公開代碼倉(cāng)庫(kù)。六、實(shí)現(xiàn)密碼加密和JWT生成創(chuàng)建app/core/security.py寫入import os from datetime import datetime, timedelta, timezone import jwt from dotenv import load_dotenv from pwdlib import PasswordHash load_dotenv() SECRET_KEY os.getenv(SECRET_KEY) ALGORITHM HS256 ACCESS_TOKEN_EXPIRE_MINUTES int( os.getenv(ACCESS_TOKEN_EXPIRE_MINUTES, 30) ) if not SECRET_KEY: raise RuntimeError(沒有配置SECRET_KEY請(qǐng)檢查.env文件) password_hash PasswordHash.recommended() def hash_password(password: str) - str: 將明文密碼轉(zhuǎn)換為密碼哈希。 return password_hash.hash(password) def verify_password( plain_password: str, hashed_password: str, ) - bool: 驗(yàn)證明文密碼是否與密碼哈希匹配。 return password_hash.verify( plain_password, hashed_password, ) def create_access_token( subject: str, expires_delta: timedelta | None None, ) - str: 生成JWT訪問令牌。 expire datetime.now(timezone.utc) ( expires_delta if expires_delta is not None else timedelta(minutesACCESS_TOKEN_EXPIRE_MINUTES) ) payload { sub: subject, exp: expire, } return jwt.encode( payload, SECRET_KEY, algorithmALGORITHM, ) def decode_access_token(token: str) - dict: 校驗(yàn)并解析JWT訪問令牌。 return jwt.decode( token, SECRET_KEY, algorithms[ALGORITHM], )JWT中保存{ sub: 用戶ID, exp: 過期時(shí)間, }其中sub表示Token對(duì)應(yīng)的主體exp表示Token過期時(shí)間。PyJWT在執(zhí)行jwt.decode()時(shí)會(huì)校驗(yàn)expToken過期后會(huì)拋出相應(yīng)異常解析時(shí)還應(yīng)顯式限制允許使用的簽名算法。七、實(shí)現(xiàn)注冊(cè)接口創(chuàng)建app/api/auth.py先寫入注冊(cè)功能import jwt from fastapi import ( APIRouter, Depends, HTTPException, status, ) from fastapi.security import ( HTTPAuthorizationCredentials, HTTPBearer, ) from sqlalchemy import select from sqlalchemy.orm import Session from app.core.security import ( create_access_token, decode_access_token, hash_password, verify_password, ) from app.database import get_db from app.models.user import User from app.schemas.user import ( TokenResponse, UserLogin, UserRegister, UserResponse, ) router APIRouter( prefix/api/auth, tags[用戶認(rèn)證], ) bearer_scheme HTTPBearer(auto_errorFalse) router.post( /register, response_modelUserResponse, status_codestatus.HTTP_201_CREATED, ) def register( data: UserRegister, db: Session Depends(get_db), ) - User: username_exists db.scalar( select(User).where( User.username data.username ) ) if username_exists: raise HTTPException( status_codestatus.HTTP_409_CONFLICT, detail用戶名已經(jīng)存在, ) email_exists db.scalar( select(User).where( User.email data.email ) ) if email_exists: raise HTTPException( status_codestatus.HTTP_409_CONFLICT, detail郵箱已經(jīng)被注冊(cè), ) user User( usernamedata.username, emaildata.email, hashed_passwordhash_password(data.password), ) try: db.add(user) db.commit() db.refresh(user) except Exception: db.rollback() raise HTTPException( status_codestatus.HTTP_500_INTERNAL_SERVER_ERROR, detail用戶注冊(cè)失敗, ) return user注冊(cè)接口的主要流程接收注冊(cè)參數(shù) ↓ 檢查用戶名是否存在 ↓ 檢查郵箱是否存在 ↓ 對(duì)密碼執(zhí)行哈希 ↓ 寫入MySQL ↓ 返回用戶基本信息八、實(shí)現(xiàn)登錄接口繼續(xù)在auth.py中加入router.post( /login, response_modelTokenResponse, ) def login( data: UserLogin, db: Session Depends(get_db), ) - TokenResponse: user db.scalar( select(User).where( User.username data.username ) ) if user is None: raise HTTPException( status_codestatus.HTTP_401_UNAUTHORIZED, detail用戶名或密碼錯(cuò)誤, ) if not verify_password( data.password, user.hashed_password, ): raise HTTPException( status_codestatus.HTTP_401_UNAUTHORIZED, detail用戶名或密碼錯(cuò)誤, ) if not user.is_active: raise HTTPException( status_codestatus.HTTP_403_FORBIDDEN, detail當(dāng)前賬號(hào)已被禁用, ) access_token create_access_token( subjectstr(user.id) ) return TokenResponse( access_tokenaccess_token, )無論用戶名不存在還是密碼錯(cuò)誤都統(tǒng)一返回用戶名或密碼錯(cuò)誤這樣可以減少接口向外部暴露賬號(hào)是否存在的信息。登錄成功后返回{ access_token: 生成的JWT字符串, token_type: bearer }九、獲取當(dāng)前登錄用戶繼續(xù)加入Token驗(yàn)證依賴def get_current_user( credentials: HTTPAuthorizationCredentials | None Depends( bearer_scheme ), db: Session Depends(get_db), ) - User: if credentials is None: raise HTTPException( status_codestatus.HTTP_401_UNAUTHORIZED, detail請(qǐng)先登錄, headers{WWW-Authenticate: Bearer}, ) try: payload decode_access_token( credentials.credentials ) user_id payload.get(sub) if user_id is None: raise HTTPException( status_codestatus.HTTP_401_UNAUTHORIZED, detail無效的登錄憑證, ) user_id_int int(user_id) except ( jwt.InvalidTokenError, ValueError, TypeError, ): raise HTTPException( status_codestatus.HTTP_401_UNAUTHORIZED, detail登錄憑證無效或已經(jīng)過期, headers{WWW-Authenticate: Bearer}, ) user db.get(User, user_id_int) if user is None: raise HTTPException( status_codestatus.HTTP_401_UNAUTHORIZED, detail用戶不存在, ) if not user.is_active: raise HTTPException( status_codestatus.HTTP_403_FORBIDDEN, detail當(dāng)前賬號(hào)已被禁用, ) return user然后創(chuàng)建受保護(hù)接口router.get( /me, response_modelUserResponse, ) def get_me( current_user: User Depends(get_current_user), ) - User: return current_user訪問/api/auth/me時(shí)必須攜帶Authorization: Bearer JWT_TOKEN否則接口會(huì)返回401。十、注冊(cè)認(rèn)證路由打開app/main.py加入認(rèn)證路由from fastapi import FastAPI from fastapi.middleware.cors import CORSMiddleware from app.api.auth import router as auth_router app FastAPI( title10天Python全棧項(xiàng)目實(shí)戰(zhàn), version1.0.0, ) app.add_middleware( CORSMiddleware, allow_origins[ http://localhost:5173, http://127.0.0.1:5173, ], allow_credentialsTrue, allow_methods[*], allow_headers[*], ) app.include_router(auth_router) app.get(/) def read_root() - dict[str, str]: return { message: FastAPI服務(wù)運(yùn)行成功, }啟動(dòng)項(xiàng)目uvicorn app.main:app --reload打開接口文檔http://127.0.0.1:8000/docs十一、測(cè)試注冊(cè)接口找到POST /api/auth/register測(cè)試參數(shù){ username: owen, email: owenexample.com, password: Python123456 }成功后返回{ id: 1, username: owen, email: owenexample.com, is_active: true }建議在這里放兩張截圖Swagger注冊(cè)成功MySQL用戶表新增數(shù)據(jù)。查看數(shù)據(jù)庫(kù)時(shí)hashed_password應(yīng)該是一段密碼哈希而不是Python123456十二、測(cè)試登錄接口找到POST /api/auth/login提交{ username: owen, password: Python123456 }成功后獲得{ access_token: 一段JWT字符串, token_type: bearer }復(fù)制access_token備用。十三、測(cè)試登錄用戶接口找到GET /api/auth/me點(diǎn)擊Swagger頁(yè)面右上角的“Authorize”輸入Bearer 你的JWT_TOKEN部分Swagger頁(yè)面只需要填寫Token本身不需要手動(dòng)寫B(tài)earer以頁(yè)面提示為準(zhǔn)。認(rèn)證成功后執(zhí)行GET /api/auth/me應(yīng)該返回{ id: 1, username: owen, email: owenexample.com, is_active: true }再測(cè)試以下情況不攜帶Token隨便修改Token等Token過期后再次請(qǐng)求。這些情況都應(yīng)該返回401而不是正常獲取用戶信息。十四、常見報(bào)錯(cuò)1. 提示找不到j(luò)wt執(zhí)行pip install pyjwt注意安裝包名稱是PyJWT代碼導(dǎo)入方式是import jwt2. 提示需要安裝email-validator執(zhí)行pip install email-validator因?yàn)镻ydantic的EmailStr依賴該組件驗(yàn)證郵箱。3. 提示沒有配置SECRET_KEY檢查.env是否位于后端項(xiàng)目根目錄backend/.env并確認(rèn)內(nèi)容為SECRET_KEY真實(shí)生成的隨機(jī)密鑰修改.env后重新啟動(dòng)FastAPI。4. 用戶表沒有hashed_password字段說明數(shù)據(jù)庫(kù)結(jié)構(gòu)仍然是Day 2的舊版本。需要更新表結(jié)構(gòu)或在沒有重要數(shù)據(jù)的開發(fā)環(huán)境中刪除舊表后重新創(chuàng)建。5. 正確密碼也登錄失敗重點(diǎn)檢查注冊(cè)時(shí)是否調(diào)用了hash_password()數(shù)據(jù)庫(kù)保存的是否為哈希結(jié)果登錄時(shí)是否使用verify_password()是否手動(dòng)修改過數(shù)據(jù)庫(kù)中的密碼字段。6. Token剛生成就提示無效重點(diǎn)檢查生成和解析Token是否使用同一個(gè)SECRET_KEY使用的算法是否都是HS256是否重啟項(xiàng)目后更換了隨機(jī)密鑰.env是否正確加載。十五、Day 3驗(yàn)收清單完成以下檢查說明Day 3已經(jīng)通過注冊(cè)接口能夠創(chuàng)建用戶用戶名不能重復(fù)郵箱不能重復(fù)密碼少于8位時(shí)校驗(yàn)失敗數(shù)據(jù)庫(kù)沒有保存明文密碼正確賬號(hào)密碼可以登錄錯(cuò)誤密碼無法登錄登錄成功可以獲得JWT Token攜帶Token可以訪問/api/auth/me不攜帶Token時(shí)返回401偽造或過期Token無法通過認(rèn)證十六、下一篇內(nèi)容Day 4將完成Vue3登錄頁(yè)面、Axios請(qǐng)求封裝、Token保存和路由守衛(wèi)。下一篇主要包括創(chuàng)建登錄頁(yè)面調(diào)用FastAPI登錄接口保存JWT TokenAxios自動(dòng)攜帶Token未登錄用戶自動(dòng)跳轉(zhuǎn)登錄頁(yè)登錄后獲取當(dāng)前用戶信息。 Python全棧實(shí)戰(zhàn) Day 3：FastAPI用戶注冊(cè)、密碼加密與JWT登錄認(rèn)證
Python全棧實(shí)戰(zhàn) Day 3用戶注冊(cè)與JWT登錄認(rèn)證前言這是“10天Python全棧項(xiàng)目實(shí)戰(zhàn)”系列的第3篇。前兩天已經(jīng)完成FastAPI與Vue3項(xiàng)目搭建第一個(gè)前后端接口調(diào)用MySQL數(shù)據(jù)庫(kù)連接SQLAlchemy用戶模型創(chuàng)建。今天將在現(xiàn)有項(xiàng)目中實(shí)現(xiàn)完整的后端用戶認(rèn)證流程用戶注冊(cè)密碼哈希用戶登錄生成JWT Token根據(jù)Token獲取當(dāng)前用戶。注意數(shù)據(jù)庫(kù)中不能直接保存用戶明文密碼只保存經(jīng)過密碼哈希算法處理后的結(jié)果。一、安裝認(rèn)證依賴進(jìn)入后端項(xiàng)目目錄并激活虛擬環(huán)境cd backend .venv\Scripts\activate安裝依賴pip install pyjwt pwdlib[argon2] python-dotenv email-validator各依賴的作用依賴作用PyJWT生成和解析JWTpwdlib密碼哈希與校驗(yàn)argon2實(shí)際使用的密碼哈希算法python-dotenv讀取環(huán)境變量email-validator校驗(yàn)郵箱格式FastAPI當(dāng)前官方JWT教程使用PyJWT處理Token并使用pwdlib處理密碼。PasswordHash.recommended()目前默認(rèn)選擇Argon2。更新依賴文件pip freeze requirements.txt二、調(diào)整項(xiàng)目結(jié)構(gòu)本文按照以下后端結(jié)構(gòu)編寫backend ├── app │ ├── api │ │ ├── __init__.py │ │ └── auth.py │ ├── core │ │ ├── __init__.py │ │ └── security.py │ ├── models │ │ ├── __init__.py │ │ └── user.py │ ├── schemas │ │ ├── __init__.py │ │ └── user.py │ ├── __init__.py │ ├── database.py │ └── main.py ├── .env ├── .gitignore └── requirements.txtdatabase.py和models/user.py應(yīng)該已經(jīng)在Day 2中創(chuàng)建。三、檢查用戶數(shù)據(jù)模型打開app/models/user.py確認(rèn)用戶表至少包含以下字段from datetime import datetime from sqlalchemy import Boolean, DateTime, String, func from sqlalchemy.orm import Mapped, mapped_column from app.database import Base class User(Base): __tablename__ users id: Mapped[int] mapped_column( primary_keyTrue, indexTrue, ) username: Mapped[str] mapped_column( String(30), uniqueTrue, indexTrue, nullableFalse, ) email: Mapped[str] mapped_column( String(100), uniqueTrue, indexTrue, nullableFalse, ) hashed_password: Mapped[str] mapped_column( String(255), nullableFalse, ) is_active: Mapped[bool] mapped_column( Boolean, defaultTrue, nullableFalse, ) created_at: Mapped[datetime] mapped_column( DateTime, server_defaultfunc.now(), nullableFalse, )這里保存的是hashed_password而不是password如果Day 2創(chuàng)建的表沒有hashed_password字段需要修改數(shù)據(jù)模型和數(shù)據(jù)庫(kù)表。開發(fā)階段沒有重要數(shù)據(jù)時(shí)可以刪除舊表后重新創(chuàng)建已有數(shù)據(jù)時(shí)應(yīng)使用數(shù)據(jù)庫(kù)遷移或執(zhí)行對(duì)應(yīng)的ALTER TABLE語句不能直接刪表。四、創(chuàng)建請(qǐng)求和響應(yīng)模型創(chuàng)建app/schemas/user.py寫入from pydantic import BaseModel, ConfigDict, EmailStr, Field class UserRegister(BaseModel): username: str Field( min_length3, max_length30, patternr^[a-zA-Z0-9_]$, ) email: EmailStr password: str Field( min_length8, max_length128, ) class UserLogin(BaseModel): username: str password: str class TokenResponse(BaseModel): access_token: str token_type: str bearer class UserResponse(BaseModel): id: int username: str email: EmailStr is_active: bool model_config ConfigDict(from_attributesTrue)這幾個(gè)模型分別負(fù)責(zé)UserRegister校驗(yàn)注冊(cè)參數(shù)UserLogin校驗(yàn)登錄參數(shù)TokenResponse定義登錄成功的返回內(nèi)容UserResponse定義返回給前端的用戶信息。不要把hashed_password放進(jìn)UserResponse否則可能將密碼哈希結(jié)果返回給前端。五、配置JWT密鑰在項(xiàng)目根目錄創(chuàng)建.env先生成隨機(jī)密鑰python -c import secrets; print(secrets.token_hex(32))終端會(huì)輸出一段隨機(jī)字符串將它復(fù)制進(jìn).envSECRET_KEY替換成剛才生成的隨機(jī)字符串 ACCESS_TOKEN_EXPIRE_MINUTES30創(chuàng)建或檢查.gitignore.venv/ __pycache__/ *.pyc .env.env中包含JWT簽名密鑰不應(yīng)該提交到公開代碼倉(cāng)庫(kù)。六、實(shí)現(xiàn)密碼加密和JWT生成創(chuàng)建app/core/security.py寫入import os from datetime import datetime, timedelta, timezone import jwt from dotenv import load_dotenv from pwdlib import PasswordHash load_dotenv() SECRET_KEY os.getenv(SECRET_KEY) ALGORITHM HS256 ACCESS_TOKEN_EXPIRE_MINUTES int( os.getenv(ACCESS_TOKEN_EXPIRE_MINUTES, 30) ) if not SECRET_KEY: raise RuntimeError(沒有配置SECRET_KEY請(qǐng)檢查.env文件) password_hash PasswordHash.recommended() def hash_password(password: str) - str: 將明文密碼轉(zhuǎn)換為密碼哈希。 return password_hash.hash(password) def verify_password( plain_password: str, hashed_password: str, ) - bool: 驗(yàn)證明文密碼是否與密碼哈希匹配。 return password_hash.verify( plain_password, hashed_password, ) def create_access_token( subject: str, expires_delta: timedelta | None None, ) - str: 生成JWT訪問令牌。 expire datetime.now(timezone.utc) ( expires_delta if expires_delta is not None else timedelta(minutesACCESS_TOKEN_EXPIRE_MINUTES) ) payload { sub: subject, exp: expire, } return jwt.encode( payload, SECRET_KEY, algorithmALGORITHM, ) def decode_access_token(token: str) - dict: 校驗(yàn)并解析JWT訪問令牌。 return jwt.decode( token, SECRET_KEY, algorithms[ALGORITHM], )JWT中保存{ sub: 用戶ID, exp: 過期時(shí)間, }其中sub表示Token對(duì)應(yīng)的主體exp表示Token過期時(shí)間。PyJWT在執(zhí)行jwt.decode()時(shí)會(huì)校驗(yàn)expToken過期后會(huì)拋出相應(yīng)異常解析時(shí)還應(yīng)顯式限制允許使用的簽名算法。七、實(shí)現(xiàn)注冊(cè)接口創(chuàng)建app/api/auth.py先寫入注冊(cè)功能import jwt from fastapi import ( APIRouter, Depends, HTTPException, status, ) from fastapi.security import ( HTTPAuthorizationCredentials, HTTPBearer, ) from sqlalchemy import select from sqlalchemy.orm import Session from app.core.security import ( create_access_token, decode_access_token, hash_password, verify_password, ) from app.database import get_db from app.models.user import User from app.schemas.user import ( TokenResponse, UserLogin, UserRegister, UserResponse, ) router APIRouter( prefix/api/auth, tags[用戶認(rèn)證], ) bearer_scheme HTTPBearer(auto_errorFalse) router.post( /register, response_modelUserResponse, status_codestatus.HTTP_201_CREATED, ) def register( data: UserRegister, db: Session Depends(get_db), ) - User: username_exists db.scalar( select(User).where( User.username data.username ) ) if username_exists: raise HTTPException( status_codestatus.HTTP_409_CONFLICT, detail用戶名已經(jīng)存在, ) email_exists db.scalar( select(User).where( User.email data.email ) ) if email_exists: raise HTTPException( status_codestatus.HTTP_409_CONFLICT, detail郵箱已經(jīng)被注冊(cè), ) user User( usernamedata.username, emaildata.email, hashed_passwordhash_password(data.password), ) try: db.add(user) db.commit() db.refresh(user) except Exception: db.rollback() raise HTTPException( status_codestatus.HTTP_500_INTERNAL_SERVER_ERROR, detail用戶注冊(cè)失敗, ) return user注冊(cè)接口的主要流程接收注冊(cè)參數(shù) ↓ 檢查用戶名是否存在 ↓ 檢查郵箱是否存在 ↓ 對(duì)密碼執(zhí)行哈希 ↓ 寫入MySQL ↓ 返回用戶基本信息八、實(shí)現(xiàn)登錄接口繼續(xù)在auth.py中加入router.post( /login, response_modelTokenResponse, ) def login( data: UserLogin, db: Session Depends(get_db), ) - TokenResponse: user db.scalar( select(User).where( User.username data.username ) ) if user is None: raise HTTPException( status_codestatus.HTTP_401_UNAUTHORIZED, detail用戶名或密碼錯(cuò)誤, ) if not verify_password( data.password, user.hashed_password, ): raise HTTPException( status_codestatus.HTTP_401_UNAUTHORIZED, detail用戶名或密碼錯(cuò)誤, ) if not user.is_active: raise HTTPException( status_codestatus.HTTP_403_FORBIDDEN, detail當(dāng)前賬號(hào)已被禁用, ) access_token create_access_token( subjectstr(user.id) ) return TokenResponse( access_tokenaccess_token, )無論用戶名不存在還是密碼錯(cuò)誤都統(tǒng)一返回用戶名或密碼錯(cuò)誤這樣可以減少接口向外部暴露賬號(hào)是否存在的信息。登錄成功后返回{ access_token: 生成的JWT字符串, token_type: bearer }九、獲取當(dāng)前登錄用戶繼續(xù)加入Token驗(yàn)證依賴def get_current_user( credentials: HTTPAuthorizationCredentials | None Depends( bearer_scheme ), db: Session Depends(get_db), ) - User: if credentials is None: raise HTTPException( status_codestatus.HTTP_401_UNAUTHORIZED, detail請(qǐng)先登錄, headers{WWW-Authenticate: Bearer}, ) try: payload decode_access_token( credentials.credentials ) user_id payload.get(sub) if user_id is None: raise HTTPException( status_codestatus.HTTP_401_UNAUTHORIZED, detail無效的登錄憑證, ) user_id_int int(user_id) except ( jwt.InvalidTokenError, ValueError, TypeError, ): raise HTTPException( status_codestatus.HTTP_401_UNAUTHORIZED, detail登錄憑證無效或已經(jīng)過期, headers{WWW-Authenticate: Bearer}, ) user db.get(User, user_id_int) if user is None: raise HTTPException( status_codestatus.HTTP_401_UNAUTHORIZED, detail用戶不存在, ) if not user.is_active: raise HTTPException( status_codestatus.HTTP_403_FORBIDDEN, detail當(dāng)前賬號(hào)已被禁用, ) return user然后創(chuàng)建受保護(hù)接口router.get( /me, response_modelUserResponse, ) def get_me( current_user: User Depends(get_current_user), ) - User: return current_user訪問/api/auth/me時(shí)必須攜帶Authorization: Bearer JWT_TOKEN否則接口會(huì)返回401。十、注冊(cè)認(rèn)證路由打開app/main.py加入認(rèn)證路由from fastapi import FastAPI from fastapi.middleware.cors import CORSMiddleware from app.api.auth import router as auth_router app FastAPI( title10天Python全棧項(xiàng)目實(shí)戰(zhàn), version1.0.0, ) app.add_middleware( CORSMiddleware, allow_origins[ http://localhost:5173, http://127.0.0.1:5173, ], allow_credentialsTrue, allow_methods[*], allow_headers[*], ) app.include_router(auth_router) app.get(/) def read_root() - dict[str, str]: return { message: FastAPI服務(wù)運(yùn)行成功, }啟動(dòng)項(xiàng)目uvicorn app.main:app --reload打開接口文檔http://127.0.0.1:8000/docs十一、測(cè)試注冊(cè)接口找到POST /api/auth/register測(cè)試參數(shù){ username: owen, email: owenexample.com, password: Python123456 }成功后返回{ id: 1, username: owen, email: owenexample.com, is_active: true }建議在這里放兩張截圖Swagger注冊(cè)成功MySQL用戶表新增數(shù)據(jù)。查看數(shù)據(jù)庫(kù)時(shí)hashed_password應(yīng)該是一段密碼哈希而不是Python123456十二、測(cè)試登錄接口找到POST /api/auth/login提交{ username: owen, password: Python123456 }成功后獲得{ access_token: 一段JWT字符串, token_type: bearer }復(fù)制access_token備用。十三、測(cè)試登錄用戶接口找到GET /api/auth/me點(diǎn)擊Swagger頁(yè)面右上角的“Authorize”輸入Bearer 你的JWT_TOKEN部分Swagger頁(yè)面只需要填寫Token本身不需要手動(dòng)寫B(tài)earer以頁(yè)面提示為準(zhǔn)。認(rèn)證成功后執(zhí)行GET /api/auth/me應(yīng)該返回{ id: 1, username: owen, email: owenexample.com, is_active: true }再測(cè)試以下情況不攜帶Token隨便修改Token等Token過期后再次請(qǐng)求。這些情況都應(yīng)該返回401而不是正常獲取用戶信息。十四、常見報(bào)錯(cuò)1. 提示找不到j(luò)wt執(zhí)行pip install pyjwt注意安裝包名稱是PyJWT代碼導(dǎo)入方式是import jwt2. 提示需要安裝email-validator執(zhí)行pip install email-validator因?yàn)镻ydantic的EmailStr依賴該組件驗(yàn)證郵箱。3. 提示沒有配置SECRET_KEY檢查.env是否位于后端項(xiàng)目根目錄backend/.env并確認(rèn)內(nèi)容為SECRET_KEY真實(shí)生成的隨機(jī)密鑰修改.env后重新啟動(dòng)FastAPI。4. 用戶表沒有hashed_password字段說明數(shù)據(jù)庫(kù)結(jié)構(gòu)仍然是Day 2的舊版本。需要更新表結(jié)構(gòu)或在沒有重要數(shù)據(jù)的開發(fā)環(huán)境中刪除舊表后重新創(chuàng)建。5. 正確密碼也登錄失敗重點(diǎn)檢查注冊(cè)時(shí)是否調(diào)用了hash_password()數(shù)據(jù)庫(kù)保存的是否為哈希結(jié)果登錄時(shí)是否使用verify_password()是否手動(dòng)修改過數(shù)據(jù)庫(kù)中的密碼字段。6. Token剛生成就提示無效重點(diǎn)檢查生成和解析Token是否使用同一個(gè)SECRET_KEY使用的算法是否都是HS256是否重啟項(xiàng)目后更換了隨機(jī)密鑰.env是否正確加載。十五、Day 3驗(yàn)收清單完成以下檢查說明Day 3已經(jīng)通過注冊(cè)接口能夠創(chuàng)建用戶用戶名不能重復(fù)郵箱不能重復(fù)密碼少于8位時(shí)校驗(yàn)失敗數(shù)據(jù)庫(kù)沒有保存明文密碼正確賬號(hào)密碼可以登錄錯(cuò)誤密碼無法登錄登錄成功可以獲得JWT Token攜帶Token可以訪問/api/auth/me不攜帶Token時(shí)返回401偽造或過期Token無法通過認(rèn)證十六、下一篇內(nèi)容Day 4將完成Vue3登錄頁(yè)面、Axios請(qǐng)求封裝、Token保存和路由守衛(wèi)。下一篇主要包括創(chuàng)建登錄頁(yè)面調(diào)用FastAPI登錄接口保存JWT TokenAxios自動(dòng)攜帶Token未登錄用戶自動(dòng)跳轉(zhuǎn)登錄頁(yè)登錄后獲取當(dāng)前用戶信息。