class BasicAuthentication(BaseAuthentication):
    """
    针对用户名密码的 HTTP 基本身份验证
    """
    www_authenticate_realm = 'api'

    def authenticate(self, request):
        """
        如果使用 HTTP 基本身份验证提供了正确的用户名和密码，则返回“User”。否则返回“None”。
        """
        # 获取请求头中`HTTP_AUTHORIZATION`，并进行分割
        auth = get_authorization_header(request).split()
        
        # 如果没有auth或者auth的第一个索引值的小写不等于basic，则返回None
        if not auth or auth[0].lower() != b'basic':
            return None
        
        # auth列表的长度必须等于2，格式['basic', 'abc.xyz.123']
        # 如果auth的长度等于1，则抛出异常
        if len(auth) == 1:
            msg = _('Invalid basic header. No credentials provided.')
            raise exceptions.AuthenticationFailed(msg)
        # 如果长度大于2，也抛出异常
        elif len(auth) > 2:
            msg = _('Invalid basic header. Credentials string should not contain spaces.')
            raise exceptions.AuthenticationFailed(msg)

        try:
            try:
                # auth[1]解码格式为utf-8
                auth_decoded = base64.b64decode(auth[1]).decode('utf-8')
            except UnicodeDecodeError:
                auth_decoded = base64.b64decode(auth[1]).decode('latin-1')
            auth_parts = auth_decoded.partition(':')
        except (TypeError, UnicodeDecodeError, binascii.Error):
            msg = _('Invalid basic header. Credentials not correctly base64 encoded.')
            raise exceptions.AuthenticationFailed(msg)

        userid, password = auth_parts[0], auth_parts[2]
        return self.authenticate_credentials(userid, password, request)

    def authenticate_credentials(self, userid, password, request=None):
        """
        Authenticate the userid and password against username and password
        with optional request for context.
        """
        credentials = {
            get_user_model().USERNAME_FIELD: userid,
            'password': password
        }
        user = authenticate(request=request, **credentials)

        if user is None:
            raise exceptions.AuthenticationFailed(_('Invalid username/password.'))

        if not user.is_active:
            raise exceptions.AuthenticationFailed(_('User inactive or deleted.'))

        return (user, None)

    def authenticate_header(self, request):
        return 'Basic realm="%s"' % self.www_authenticate_realm

自定义认证类

1. 创建继承BaseAuthentication的认证类
2. 实现authenticate方法
3. 实现体根据认证规则 确定 游客 正常用户 非法用户
4. 进行全局或局部配置（一般采用全局配置）

认证规则

1. 没有认证信息，返回None（游客）
2. 有认证信息认证失败，抛异常（非法用户）
3. 有认证信息认证成功，返回用户和认证信息的元组（合法用户）

我们创建一个文件夹authentications，写入如下代码

from rest_framework.authentication import BaseAuthentication
from rest_framework.exceptions import AuthenticationFailed
from api.models import User


class MyAuthentications(BaseAuthentication):

    def authenticate(self, request):
        # 前台在请求头携带认证信息
        # 且默认规范用Authorization字段携带认证信息
        # 后台固定在请求对象的META字段中的HTTP_AUTHORIZATION获取
        auth = request.META.get('HTTP_AUTHORIZATION', None)

        # 处理游客
        if auth is None:
            return None

        auth_list = auth.split()
        if not len(auth_list) == 2 and auth_list[0].lower() == "auth":
            raise AuthenticationFailed("认证信息有误，非法用户")
        # 合法的用户还需要从auth_list[1]中解析出来
        # 注：假设一种情况，信息为xx.yy.zz，就可以解析出admin用户：实际开发，该逻辑一定是校验用户的正常逻辑
        if auth_list[1] != 'xx.yy.zz':  # 校验失败
            raise AuthenticationFailed("用户校验失败，非法用户")

        user = User.objects.filter(username='jkc').first()
        print(user)

        if not user:
            raise AuthenticationFailed("用户数据有误，非法用户")

        return user, None

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'api.authentications.MyAuthentications'
    ],
}

class TestView(APIView):
    def get(self, request, *args, **kwargs):
        return APIResponse(data_msg="drf get ok")

{
    "statusCode": 0,
    "message": "drf get ok"
}

{
    "detail": "认证信息有误，非法用户"
}

{
    "detail": "用户校验失败，非法用户"
}

{
    "statusCode": 0,
    "message": "drf get ok"
}