登录访问令牌 422 验证错误 FastApi

Question

我想使用此代码在我的网站上进行授权（使用此特定授权选项对我来说并不重要。如果您有其他选项在网站上实现授权，我将很乐意考虑它们）

def get_db():
    db = SessionLocal()
    try:
        yield db
    finally:
        db.close()


SECRET_KEY = "somekeyfasfascsacs"
ALGORITHM = "HS256"

bcrypt_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

oauth2_bearer = OAuth2PasswordBearer(tokenUrl="auth/token")


db_dependency = Annotated[Session, Depends(get_db)]


def authenticate_user(username: str, password: str, db: db_dependency):
    user = db.query(Users).filter(Users.username == username).first()
    if not user:
        return False
    if not bcrypt_context.verify(password, user.hashed_password):
        return False
    print(type(user))
    return user


def create_access_token(username: str, user_id: int,
                        expires_delta: Optional[datetime.timedelta] = None):

    encode = {"sub": username, "id": user_id}
    if expires_delta:
        expire = datetime.datetime.utcnow() + expires_delta
    else:
        expire = datetime.datetime.utcnow() + datetime.timedelta(minutes=15)
    encode.update({"exp": expire})
    return jwt.encode(encode, SECRET_KEY, algorithm=ALGORITHM)


async def get_current_user(token: Annotated[str, Depends(oauth2_bearer)]):
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        username: str = payload.get("sub")
        user_id: int = payload.get("id")
        user_role: str = payload.get("role")
        if username is None or user_id is None:
            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Could not validate user")
        return {"username": username, "id": user_id, "user_role": user_role}
    except JWTError:
        # When authorizing using a button and trying to use other functions,
        # it gives this error
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Could not validate user")


@router.post("/token")
async def login_for_access_token(response: Response, form_data: OAuth2PasswordRequestForm = Depends(),
                                 db: Session = Depends(get_db)):

    user = authenticate_user(form_data.username, form_data.password, db)
    if not user:
        return False
    token_expires = datetime.timedelta(minutes=60)
    token = create_access_token(user.username,
                                user.id,
                                expires_delta=token_expires)

    response.set_cookie(key="access_token", value=token, httponly=True)

    return True

但我收到此错误：

如果您通过 Autorize 按钮登录，它不会给您错误，但是当您尝试使用其他功能时，该网站会给您一个 401 Unautorize 错误。

Answer 1

您应该在

async def login_for_access_token

中返回令牌，而不是返回

True

。

如果您使用

OAuth2PasswordBearer

身份验证模式，则 Swager（文档系统）期望在响应正文中接收令牌，而不是在 cookie 中。

return {"access_token": user.username, "token_type": "bearer"}