#Token验证，会生成表

    'rest_framework.authtoken',

REST_FRAMEWORK = {

    'DEFAULT_AUTHENTICATION_CLASSES': (

        'rest_framework.authentication.BasicAuthentication',

        'rest_framework.authentication.SessionAuthentication',

        'rest_framework.authentication.TokenAuthentication',

        #添加Token验证，如果Token过期，不需要登录的界面也不能访问，最好配置在具体的页面

),

from rest_framework.authtoken import views

#配置url

urlpatterns += [

    url(r'^api-token-auth/', views.obtain_auth_token)

]

def get_authorization_header(request):

    """

    Return request's 'Authorization:' header, as a bytestring.

    Hide some test client ickyness where the header can be unicode.

    """

    auth = request.META.get('HTTP_AUTHORIZATION', b'')

    if isinstance(auth, text_type):

        # Work around django test client oddness

        auth = auth.encode(HTTP_HEADER_ENCODING)

    return auth

    def authenticate(self, request):

        auth = get_authorization_header(request).split()

        if not auth or auth[0].lower() != self.keyword.lower().encode():

            return None

        if len(auth) == 1:

            msg = _('Invalid token header. No credentials provided.')

            raise exceptions.AuthenticationFailed(msg)

        elif len(auth) > 2:

            msg = _('Invalid token header. Token string should not contain spaces.')

            raise exceptions.AuthenticationFailed(msg)

        try:

            token = auth[1].decode()

        except UnicodeError:

            msg = _('Invalid token header. Token string should not contain invalid characters.')

            raise exceptions.AuthenticationFailed(msg)

        return self.authenticate_credentials(token)

 def authenticate_credentials(self, key):

        model = self.get_model()

        try:

            token = model.objects.select_related('user').get(key=key)

        except model.DoesNotExist:

            raise exceptions.AuthenticationFailed(_('Invalid token.'))

        if not token.user.is_active:

            raise exceptions.AuthenticationFailed(_('User inactive or deleted.'))

        return (token.user, token)

from rest_framework import permissions

class BlacklistPermission(permissions.BasePermission):

    """

    Global permission check for blacklisted IPs.

    """

    def has_permission(self, request, view):

        ip_addr = request.META['REMOTE_ADDR']

        blacklisted = Blacklist.objects.filter(ip_addr=ip_addr).exists()

        return not blacklisted

class IsOwnerOrReadOnly(permissions.BasePermission):

    """

    Object-level permission to only allow owners of an object to edit it.

    Assumes the model instance has an `owner` attribute.

    """

    def has_object_permission(self, request, view, obj):

        # Read permissions are allowed to any request,

        # so we'll always allow GET, HEAD or OPTIONS requests.

        if request.method in permissions.SAFE_METHODS:

            return True

        # Instance must have an attribute named `owner`.

        return obj.owner == request.user

from rest_framework import permissions

class IsOwnerOrReadOnly(permissions.BasePermission):

    def has_object_permission(self, request, view, obj):

        # Read permissions are allowed to any request,

        # so we'll always allow GET, HEAD or OPTIONS requests.

        if request.method in permissions.SAFE_METHODS:

            return True

        # Instance must have an attribute named `owner`.

        return obj.user == request.user

......

from utils.permissions import IsOwnerOrReadOnly

# Create your views here.

class UserFavViewset(mixins.CreateModelMixin, mixins.ListModelMixin, mixins.RetrieveModelMixin,

                     mixins.DestroyModelMixin, viewsets.GenericViewSet):

    '''

    list:

        获取用户收藏列表

    retrieve:

        判断某个商品是否收藏

    create:

        收藏商品

    '''

    # queryset = UserFav.objects.all()

    permission_classes = (IsAuthenticated, IsOwnerOrReadOnly)

......

from rest_framework import permissions

from rest_framework import authentication

from rest_framework_jwt.authentication import JSONWebTokenAuthentication

......

class UserViewset(mixins.CreateModelMixin,mixins.UpdateModelMixin,mixins.RetrieveModelMixin,viewsets.GenericViewSet):

    '''

    用户

    '''

    serializer_class = UserRegSerializer

    queryset = User.objects.all()

    authentication_classes = (JSONWebTokenAuthentication,authentication.SessionAuthentication)

    #更新，添加用户信息放在一起，是否登录应该动态，注册不用登录IsAuthenticated，该方法不行

    # permission_classes = (permissions.IsAuthenticated)

    def create(self, request, *args, **kwargs):

        serializer = self.get_serializer(data=request.data)

        serializer.is_valid(raise_exception=True)

        user=self.perform_create(serializer)

        re_dict=serializer.data

        payload=jwt_payload_handler(user)

        re_dict['token']=jwt_encode_handler(payload)

        re_dict['name']=user.name if user.name else user.username

        headers = self.get_success_headers(serializer.data)

        return Response(re_dict, status=status.HTTP_201_CREATED, headers=headers)

    def get_serializer_class(self):

        '''

        重载GenericAPIView中的get_serializer_class函数，调用不同的序列化类，如果是create,

        就调用UserRegSerializer序列化，否则UserDetailSerializer序列化

        :return:

        '''

        if self.action == 'retrieve':

            return UserDetailSerializer

        elif self.action == 'create':

            return UserRegSerializer

        return UserDetailSerializer

    def get_permissions(self):

        '''

        重载APIview中的get_perimissions函数，如果是新增用户则不用登录，否则必须登录

        :return:

        '''

        if self.action == 'retrieve':

            return [permissions.IsAuthenticated()]

        elif self.action == 'create':

            return []

        return []

    def get_object(self):

        '''

        返回当前用户

        :return:

        '''

        return self.request.user

    def perform_create(self, serializer):

        return serializer.save()