最好让移动客户端定期更新其身份验证令牌。这当然要由服务器来实施。
默认的TokenAuthentication类不支持此功能，但是你可以对其进行扩展以实现此功能。
例如：
from rest_framework.authentication import TokenAuthentication, get_authorization_header
from rest_framework.exceptions import AuthenticationFailed
class ExpiringTokenAuthentication(TokenAuthentication):
def authenticate_credentials(self, key):
try:
token = self.model.objects.get(key=key)
except self.model.DoesNotExist:
raise exceptions.AuthenticationFailed('Invalid token')
if not token.user.is_active:
raise exceptions.AuthenticationFailed('User inactive or deleted')
# This is required for the time comparison
utc_Now = datetime.utcNow()
utc_Now = utc_Now.replace(tzinfo=pytz.utc)
if token.created < utc_Now - timedelta(hours=24):
raise exceptions.AuthenticationFailed('Token has expired')
return token.user, token
还需要覆盖默认的rest框架登录视图，以便在登录完成后刷新令牌：
class ObtainExpiringAuthToken(ObtainAuthToken):
def post(self, request):
serializer = self.serializer_class(data=request.data)
if serializer.is_valid():
token, created = Token.objects.get_or_create(user=serializer.validated_data['user'])
if not created:
# update the created time of the token to keep it valid
token.created = datetime.datetime.utcNow()
token.save()
return Response({'token': token.key})
return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
obtain_expiring_auth_token = ObtainExpiringAuthToken.as_view()
并且不要忘记修改网址：
urlpatterns += patterns(
'',
url(r'^users/login/?$', '<path_to_file>.obtain_expiring_auth_token'),
)
602392714
清零编程群