Django RestFramework JWT令牌：获取用户DoesNotExist错误

删除用户后，客户端上的令牌在时间到期之前仍然有效。问题是django Restframework不处理来自已删除用户的请求，并导致500个错误。我怎样才能防止这种情况

aceback (most recent call last):
  File "/lib/python3.6/site-packages/django/core/handlers/exception.py", line 47, in inner
    response = get_response(request)
  File "/lib/python3.6/site-packages/django/core/handlers/base.py", line 179, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/lib/python3.6/site-packages/django/views/decorators/csrf.py", line 54, in wrapped_view
    return view_func(*args, **kwargs)
  File "/lib/python3.6/site-packages/django/views/generic/base.py", line 70, in view
    return self.dispatch(request, *args, **kwargs)
  File "/lib/python3.6/site-packages/rest_framework/views.py", line 505, in dispatch
    response = self.handle_exception(exc)
  File "/lib/python3.6/site-packages/rest_framework/views.py", line 465, in handle_exception
    self.raise_uncaught_exception(exc)
  File "/lib/python3.6/site-packages/rest_framework/views.py", line 476, in raise_uncaught_exception
    raise exc
  File "/lib/python3.6/site-packages/rest_framework/views.py", line 493, in dispatch
    self.initial(request, *args, **kwargs)
  File "/lib/python3.6/site-packages/rest_framework/views.py", line 410, in initial
    self.perform_authentication(request)
  File "/lib/python3.6/site-packages/rest_framework/views.py", line 324, in perform_authentication
    request.user
  File "/lib/python3.6/site-packages/rest_framework/request.py", line 220, in user
    self._authenticate()
  File "/lib/python3.6/site-packages/rest_framework/request.py", line 373, in _authenticate
    user_auth_tuple = authenticator.authenticate(self)
  File "/lib/python3.6/site-packages/rest_framework_jwt/authentication.py", line 33, in authenticate
    payload = jwt_decode_handler(jwt_value)
  File "/lib/python3.6/site-packages/rest_framework_jwt/utils.py", line 105, in jwt_decode_handler
    secret_key = jwt_get_secret_key(unverified_payload)
  File "/lib/python3.6/site-packages/rest_framework_jwt/utils.py", line 26, in jwt_get_secret_key
    user = User.objects.get(pk=payload.get('user_id'))
  File "/lib/python3.6/site-packages/django/db/models/manager.py", line 85, in manager_method
    return getattr(self.get_queryset(), name)(*args, **kwargs)
  File "/lib/python3.6/site-packages/django/db/models/query.py", line 431, in get
    self.model._meta.object_name

---

从JWT令牌，您将对其进行解码以获取用户id-

有效负载['user\u id']

。 发生错误的原因是

User.objects.get（pk=payload.get（'User\u id'））

您可以使用

get\u对象或\u 404来代替get。像这样使用它：

from django.shortcuts import get_object_or_404

payload = jwt_decode_handler(jwt_value)
user = get_object_or_404 (User, pk=payload.get('user_id'))

这会在找不到用户时引发404错误；这将通过视图和处理程序冒泡出来，返回404状态码。
Druhn Bala的建议有效，但会返回404错误，这对于我的用例来说并不理想。相反，我提出了一个返回自定义响应的方法<代码>验证错误

从

rest\u framework.exceptions

可以发送400错误和自定义响应

def jwt_decode_handler(token):
    options = {
        'verify_exp': api_settings.JWT_VERIFY_EXPIRATION,
    }
    # get user from token, BEFORE verification, to get user secret key
    try:
        unverified_user = jwt.decode(token, None, False)
    except User.DoesNotExist:
        raise ValidationError({"errors": ['Oops! Something went wrong, please logout and login back in!']})

        secret_key = unverified_user.securitysettings.jwt_secret #my custom way of storing a unique jwt uuid per user. 
    return jwt.decode(
        token,
        api_settings.JWT_PUBLIC_KEY or secret_key,
        api_settings.JWT_VERIFY,
        options=options,
        leeway=api_settings.JWT_LEEWAY,
        audience=api_settings.JWT_AUDIENCE,
        issuer=api_settings.JWT_ISSUER,
        algorithms=[api_settings.JWT_ALGORITHM]
    )

最后，我们在

settings.py

中将自定义解码处理程序设置为默认值

JWT_AUTH = {
    'JWT_DECODE_HANDLER':
    'registration.decoder.jwt_decode_handler',
    ...
}

---

啊，愚蠢的时刻，我需要编写一个自定义解码处理程序，而不是使用默认值。