44 lines
1.6 KiB
Python
44 lines
1.6 KiB
Python
import logging
|
||
|
||
from django.core.cache import cache
|
||
from rest_framework.exceptions import APIException
|
||
from rest_framework_simplejwt.authentication import JWTAuthentication
|
||
from rest_framework_simplejwt.exceptions import InvalidToken
|
||
|
||
logger = logging.getLogger(__name__)
|
||
|
||
_REVOKED = {'code': 'AUTH_TOKEN_REVOKED', 'message': 'token已被吊销，请重新登录'}
|
||
_INVALIDATED = {'code': 'AUTH_TOKEN_INVALIDATED', 'message': 'token已失效，请重新登录'}
|
||
_REDIS_DOWN = {'code': 'SYS_DEPENDENCY_DOWN', 'message': 'Redis服务不可用'}
|
||
|
||
|
||
class RedisBlacklistJWTAuthentication(JWTAuthentication):
|
||
"""在 simplejwt 校验通过后追加 Redis 黑名单检查。"""
|
||
|
||
def get_validated_token(self, raw_token):
|
||
token = super().get_validated_token(raw_token)
|
||
try:
|
||
jti = token.payload.get('jti')
|
||
uid = token.payload.get('user_id')
|
||
iat = token.payload.get('iat')
|
||
|
||
if jti and cache.get(f'jwt_blacklist:{jti}'):
|
||
raise InvalidToken(_REVOKED)
|
||
|
||
if uid and iat is not None:
|
||
invalid_before = cache.get(f'jwt_user_invalid_before:{uid}')
|
||
if invalid_before is not None and iat < int(invalid_before):
|
||
raise InvalidToken(_INVALIDATED)
|
||
|
||
except InvalidToken:
|
||
raise
|
||
except Exception as e:
|
||
# fail-closed：Redis 不可用时拒绝请求（安全 > 可用）
|
||
logger.error('Redis error during JWT blacklist check: %s', e)
|
||
ex = APIException()
|
||
ex.status_code = 503
|
||
ex.detail = _REDIS_DOWN
|
||
raise ex
|
||
|
||
return token
|