如何在Django中自定义JWT认证错误响应

需求说明 #

• 视图需验证请求中携带的JWT Token有效性
• Token有效（用户已登录）：返回指定车辆数据，状态码为200 OK
• Token无效/未携带（用户未认证）：返回相同的车辆数据，状态码为401 UNAUTHENTICATED
• 核心目标：判断请求发起用户是否已登录

尝试的代码 #

permission_classes = [IsAuthenticated]

def get(self, request):
    try:
        # 查询车辆数据
        GpCars = Car.objects.order_by(
            '-stockid').filter(gpcar=True, featured=False)[:6]
        FeaturedCars = Car.objects.order_by(
            '-stockid').filter(gpcar=False, featured=True)[:6]
        RecentCars = Car.objects.order_by(
            '-stockid').filter(gpcar=False, featured=False)[:6]

        # 序列化数据
        gpSerial = CarSerializer(GpCars, many=True)
        featSerial = CarSerializer(FeaturedCars, many=True)
        RecentSerial = CarSerializer(RecentCars, many=True)

        time.sleep(5)
        return Response({"gpcars": gpSerial.data, "featuredCars": featSerial.data, "recentcars": RecentSerial.data}, status=status.HTTP_200_OK)
    except Exception as e:
        # 处理异常
        return Response({"gpcars": gpSerial.data, "featuredCars": featSerial.data, "recentcars": RecentSerial.data}, status=status.HTTP_401_UNAUTHENTICATED)

问题分析与修正方案 #

原代码问题 #

1. 使用permission_classes = [IsAuthenticated]会直接拦截未认证请求，无法进入视图函数返回指定的401响应数据
2. try-except块仅捕获查询/序列化异常，不处理认证失败场景；若进入except分支，gpSerial等变量可能未定义，会触发新错误

正确实现代码 #

from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import status
from .models import Car
from .serializers import CarSerializer
import time

class CarDataView(APIView):
    def get(self, request):
        # 查询车辆数据
        gp_cars = Car.objects.order_by('-stockid').filter(gpcar=True, featured=False)[:6]
        featured_cars = Car.objects.order_by('-stockid').filter(gpcar=False, featured=True)[:6]
        recent_cars = Car.objects.order_by('-stockid').filter(gpcar=False, featured=False)[:6]

        # 序列化数据
        gp_serial = CarSerializer(gp_cars, many=True)
        feat_serial = CarSerializer(featured_cars, many=True)
        recent_serial = CarSerializer(recent_cars, many=True)

        response_data = {
            "gpcars": gp_serial.data,
            "featuredCars": feat_serial.data,
            "recentcars": recent_serial.data
        }

        # 根据用户认证状态返回对应状态码
        if request.user.is_authenticated:
            return Response(response_data, status=status.HTTP_200_OK)
        else:
            return Response(response_data, status=status.HTTP_401_UNAUTHENTICATED)

说明 #

• 需确保项目已配置JWT认证（如使用djangorestframework-simplejwt），DRF会自动解析请求中的JWT Token，将认证用户赋值给request.user，未认证时为AnonymousUser
• 直接通过request.user.is_authenticated判断用户登录状态，无论认证是否通过，都返回相同数据，仅状态码不同
• 移除了不必要的try-except（若需处理查询/序列化异常，可单独捕获并处理，但不要与认证逻辑混淆）

内容的提问来源于stack exchange，提问作者Yasin Shah