blocks|key|3990660|text|从外观上看，Collection有一个authentication参数。(参见本例：authentication.py)|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|3990661|其次，(即使Django还没有)可能应该有一个中间件来执行CSRF/XSRF表单检查。(哦，看起来像是be+one。)您还应该能够在urls.py中使用login_required+and+permission_required+decorators。|3990662|entityMap|0|LINK|mutability|MUTABLE|url|http://django-rest-interface.googlecode.com/svn/trunk/django_restapi_tests/examples/authentication.py|1|http://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ref-contrib-csrf|2|http://docs.djangoproject.com/en/dev/topics/auth/#topics-auth^0|6|A|J|E|16|H|0|0|24|E|2N|J|1F|6|1|24|1D|2|0^^$0|@$1|2|3|4|5|6|7|T|8|@$9|U|A|V|B|C]|$9|W|A|X|B|C]]|D|@$9|Y|A|Z|1|10]]|E|$]]|$1|F|3|G|5|6|7|11|8|@$9|12|A|13|B|C]|$9|14|A|15|B|C]]|D|@$9|16|A|17|1|18]|$9|19|A|1A|1|1B]]|E|$]]|$1|H|3|-4|5|6|7|1C|8|@]|D|@]|E|$]]]|I|$J|$5|K|L|M|E|$N|O]]|P|$5|K|L|M|E|$N|Q]]|R|$5|K|L|M|E|$N|S]]]]

Well, from the look of things, there's an <code>authentication</code> parameter to <code>Collection</code>. (see this example: <a href="http://django-rest-interface.googlecode.com/svn/trunk/django_restapi_tests/examples/authentication.py" rel="nofollow noreferrer">authentication.py</a>)

Second, (even if Django doesn't have it yet,) there should probably be a middleware that does CSRF/XSRF form checking. (Oh, there seems to <a href="http://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ref-contrib-csrf" rel="nofollow noreferrer">be one</a>.) You should also be able to use the <a href="http://docs.djangoproject.com/en/dev/topics/auth/#topics-auth" rel="nofollow noreferrer"><code>login_required</code> and <code>permission_required</code> decorators</a> in the urls.py.

blocks|key|3145746|text|即使使用Authentication参数，您也无法细粒度地控制用户可以执行的操作。Django-REST接口的当前实现不跟踪用户信息，因此您没有这些信息可用于进行细粒度的授权检查。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3145747|参见Issue+#32。|offset|length|3145748|但是，对其进行扩展以添加一些功能相对容易。我使用了很多子类来添加特性。|3145749|然而，在Django中，使用登录信息更新请求是很棘手的。而不是这样做，我将信息留在集合中。|3145750|现在，我估计在补丁和子类之间，我所编写的内容与使用我自己的RESTful视图函数一样大。|3145751|然而，Django-REST优雅而整洁地处理HTTP摘要身份验证。我不希望为我的Django视图函数使用某种装饰器来取代他们的装饰器。|3145752|也许我们应该打开一个源代码伪造项目，并设计出一个干净的替代品？|3145753|entityMap|0|LINK|mutability|MUTABLE|url|http://code.google.com/p/django-rest-interface/issues/detail?id=32^0|0|2|9|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Y|8|@]|9|@$D|Z|E|10|1|11]]|A|$]]|$1|F|3|G|5|6|7|12|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|13|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|14|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|15|8|@]|9|@]|A|$]]|$1|N|3|O|5|6|7|16|8|@]|9|@]|A|$]]|$1|P|3|-4|5|6|7|17|8|@]|9|@]|A|$]]]|Q|$R|$5|S|T|U|A|$V|W]]]]

Even with the Authentication parameter, you don't have fine-grained control over what people can do. The current implementation of the Django-REST interface doesn't track the user information, so you don't have this information available for doing fine-grained authorization checks.

See <a href="http://code.google.com/p/django-rest-interface/issues/detail?id=32" rel="nofollow noreferrer">Issue #32</a>.

However, it's relatively easy to extend it to add some features. I use a lot of subclasses to add features.

Updating the request with login information, however, is tricky in Django. Rather than do that, I leave the information in the Collection.

Right now, I'd estimate that between patches and subclasses, what I've written is about as big as rolling my own RESTful view functions. 

Django-REST, however, gracefully and neatly handles HTTP Digest Authentication. I don't look forward to replacing theirs with some kind of decorator for my Django view functions.

[Maybe we should open a source forge project and work out a clean replacement?]

blocks|key|3145812|text|如果安全性是您最关心的问题，我会考虑使用django-piston+http://bitbucket.org/jespern/django-piston/wiki/Home应用程序。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3145813|我在过去使用过django-rest-interface，它很可靠，虽然简单，但功能相当强大，但是django-piston看起来更灵活。|3145814|entityMap|0|LINK|mutability|MUTABLE|url|http://bitbucket.org/jespern/django-piston/wiki/Home^0|Y|1G|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

I would look into using django-piston <a href="http://bitbucket.org/jespern/django-piston/wiki/Home" rel="noreferrer">http://bitbucket.org/jespern/django-piston/wiki/Home</a> application if security is your main concern. 

I have used django-rest-interface in the past, its reliable and though simple can be quite powerful, however django-piston seems more flexible going forward.

blocks|key|3990888|text|请一定要看看django-rest-framework，我刚从tastypie过渡到这个新的框架，效果很好！|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3990889|http://django-rest-framework.org/|offset|length|3990890|尤其是基于类的视图和可浏览的api！以及许多其他优点(例如，上传图片)|3990891|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|X|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@$D|Q|E|R|1|S]]|A|$]]|$1|F|3|G|5|6|7|T|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|U|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|C]]]]

Please do have a look at django-rest-framework, I just stepped over from tastypie to this new framework, works great!

<a href="http://django-rest-framework.org/" rel="nofollow">http://django-rest-framework.org/</a>

Especially the class based views and the browsable api! and many other advantages (e..g. to upload images)

I have a django application that I'd like to add some rest interfaces to. I've seen <a href="http://code.google.com/p/django-rest-interface/" rel="noreferrer">http://code.google.com/p/django-rest-interface/</a> but it seems to be pretty simplistic. For instance it doesn't seem to have a way of enforcing security. How would I go about limiting what people can view and manipulate through the rest interface? Normally I'd put this kind of logic in my views. Is this the right place or should I be moving some more logic down into the model? Alternatively is there a better library out there or do I need to roll my own?

Using django-rest-interface

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我有一个想要添加一些rest接口的django应用程序。我见过，但它似乎太简单了。例如，它似乎没有一种增强安全性的方法。我该如何限制人们可以通过rest界面查看和操作的内容？通常情况下，我会把这种逻辑放在我的观点中。这是正确的地方吗?或者我应该将更多的逻辑下移到模型中？或者，有没有更好的库，或者我需要推出自己的库？

问使用django-rest-interface
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用django-rest-interfaceEN