Python 之 jwt 令牌生成和校验

JWT的生成与校验，核心是一个无状态的交互流程。服务器生成令牌后，客户端在后续请求中携带它，服务器只需验证令牌本身即可，无需保存会话状态。jwt 的交互流程如下。

Python 生成和校验 jwt 的常用方式有下面这几种。

itsdangerous

可以生成包含时间戳、对 URL 安全的签名令牌。一般用于生成轻量的非标准的 API 认证令牌。

python 复制代码

import uuid
import secrets
from itsdangerous.url_safe import URLSafeTimedSerializer as Serializer


def generate_secret_key():
    secret_key = secrets.token_hex(32)
    print(f"secret_key: {secret_key}")
    return secret_key


def generate_access_token():
    access_token = uuid.uuid1().hex
    print(f"access_token: {access_token}")
    return access_token


SECRET_KEY = generate_secret_key()
ACCESS_TOKEN = generate_access_token()


def encode_jwt(access_token):
    jwt = Serializer(secret_key=SECRET_KEY)
    return jwt.dumps(access_token)


def decode_jwt(jwt_token):
    jwt = Serializer(secret_key=SECRET_KEY)
    payload = jwt.loads(jwt_token)
    return payload


if __name__ == '__main__':
    payload = {"user_id": ACCESS_TOKEN, "username": "Looking"}
    auth_token = encode_jwt(payload)
    print(f"auth_token: {auth_token}")

    payload = decode_jwt(auth_token)
    print(f"payload: {payload}")

python 复制代码

secret_key: 2bcc46556f275ef90edf09104829aef4c2a8fd1c0f4d0c83d34e96b552518295
access_token: b6065d22a51711f1bbc2489ebd2d776f
auth_token: eyJ1c2VyX2lkIjoiYjYwNjVkMjJhNTE3MTFmMWJiYzI0ODllYmQyZDc3NmYiLCJ1c2VybmFtZSI6Ikxvb2tpbmcifQ.apU-JA.gjI87rWbCsIlQ2R-goAZOdDhJ5o
payload: {'user_id': 'b6065d22a51711f1bbc2489ebd2d776f', 'username': 'Looking'}

PYJWT

目前最核心、最流行的 JWT 库，它提供了最基础的生成与验证功能，是其他许多库的底层依赖。

python 复制代码

import jwt
import uuid
import secrets



def generate_secret_key():
    secret_key = secrets.token_hex(32)
    print(f"secret_key: {secret_key}")
    return secret_key


def generate_access_token():
    access_token = uuid.uuid1().hex
    print(f"access_token: {access_token}")
    return access_token


SECRET_KEY = generate_secret_key()
ACCESS_TOKEN = generate_access_token()


def encode_jwt(payload):
    token = jwt.encode(payload, SECRET_KEY, algorithm="HS256")
    return token


def decode_jwt(jwt_token):
    payload = jwt.decode(jwt_token, SECRET_KEY, algorithms=["HS256"])
    return payload


if __name__ == '__main__':
    payload = {"user_id": ACCESS_TOKEN, "username": "Looking"}
    auth_token = encode_jwt(payload)
    print(f"auth_token: {auth_token}")

    payload = decode_jwt(auth_token)
    print(f"payload: {payload}")

python 复制代码

secret_key: b56c0da985b4b5f0cecda3dce931ea1bec0340c6e0494cd280f20076acd91695
access_token: 52776fe6a51311f195a1489ebd2d776f
auth_token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoiNTI3NzZmZTZhNTEzMTFmMTk1YTE0ODllYmQyZDc3NmYiLCJ1c2VybmFtZSI6Ikxvb2tpbmcifQ.ycHmDEYoXbIIZIwFXasVMTDW2ELzcp118YMJvW6xKao
payload: {'user_id': '52776fe6a51311f195a1489ebd2d776f', 'username': 'Looking'}