aboutsummaryrefslogtreecommitdiffstats
path: root/djangorestframework/authentication.py
diff options
context:
space:
mode:
Diffstat (limited to 'djangorestframework/authentication.py')
-rw-r--r--djangorestframework/authentication.py101
1 files changed, 0 insertions, 101 deletions
diff --git a/djangorestframework/authentication.py b/djangorestframework/authentication.py
deleted file mode 100644
index f46a9c46..00000000
--- a/djangorestframework/authentication.py
+++ /dev/null
@@ -1,101 +0,0 @@
-"""
-The :mod:`authentication` module provides a set of pluggable authentication classes.
-
-Authentication behavior is provided by mixing the :class:`mixins.AuthMixin` class into a :class:`View` class.
-
-The set of authentication methods which are used is then specified by setting the
-:attr:`authentication` attribute on the :class:`View` class, and listing a set of :class:`authentication` classes.
-"""
-
-from django.contrib.auth import authenticate
-from djangorestframework.compat import CsrfViewMiddleware
-import base64
-
-__all__ = (
- 'BaseAuthentication',
- 'BasicAuthentication',
- 'UserLoggedInAuthentication'
-)
-
-
-class BaseAuthentication(object):
- """
- All authentication classes should extend BaseAuthentication.
- """
-
- def __init__(self, view):
- """
- :class:`Authentication` classes are always passed the current view on creation.
- """
- self.view = view
-
- def authenticate(self, request):
- """
- Authenticate the :obj:`request` and return a :obj:`User` or :const:`None`. [*]_
-
- .. [*] The authentication context *will* typically be a :obj:`User`,
- but it need not be. It can be any user-like object so long as the
- permissions classes (see the :mod:`permissions` module) on the view can
- handle the object and use it to determine if the request has the required
- permissions or not.
-
- This can be an important distinction if you're implementing some token
- based authentication mechanism, where the authentication context
- may be more involved than simply mapping to a :obj:`User`.
- """
- return None
-
-
-class BasicAuthentication(BaseAuthentication):
- """
- Use HTTP Basic authentication.
- """
-
- def authenticate(self, request):
- """
- Returns a :obj:`User` if a correct username and password have been supplied
- using HTTP Basic authentication. Otherwise returns :const:`None`.
- """
- from django.utils.encoding import smart_unicode, DjangoUnicodeDecodeError
-
- if 'HTTP_AUTHORIZATION' in request.META:
- auth = request.META['HTTP_AUTHORIZATION'].split()
- if len(auth) == 2 and auth[0].lower() == "basic":
- try:
- auth_parts = base64.b64decode(auth[1]).partition(':')
- except TypeError:
- return None
-
- try:
- uname, passwd = smart_unicode(auth_parts[0]), smart_unicode(auth_parts[2])
- except DjangoUnicodeDecodeError:
- return None
-
- user = authenticate(username=uname, password=passwd)
- if user is not None and user.is_active:
- return user
- return None
-
-
-class UserLoggedInAuthentication(BaseAuthentication):
- """
- Use Django's session framework for authentication.
- """
-
- def authenticate(self, request):
- """
- Returns a :obj:`User` if the request session currently has a logged in user.
- Otherwise returns :const:`None`.
- """
- self.view.DATA # Make sure our generic parsing runs first
-
- if getattr(request, 'user', None) and request.user.is_active:
- # Enforce CSRF validation for session based authentication.
- resp = CsrfViewMiddleware().process_view(request, None, (), {})
-
- if resp is None: # csrf passed
- return request.user
- return None
-
-
-# TODO: TokenAuthentication, DigestAuthentication, OAuthAuthentication