authorization.py 文件源码

def _verify_user_by_token(self, user, token, ip):
        tokens_valid_for_seconds = self._config.defaults['authorization']['tokens_valid_for_seconds']
        self._mongo.db['tokens'].delete_many({'timestamp': {'$lt': time() - tokens_valid_for_seconds}})
        cursor = self._mongo.db['tokens'].find(
            {'username': user['username'], 'ip': ip},
            {'token': 1, 'salt': 1}
        )
        for c in cursor:
            try:
                kdf = _kdf(c['salt'])
                kdf.verify(token.encode('utf-8'), c['token'])
                return True
            except:
                pass
        return False