florimondmanca / djangorestframework-api-key

🔐 API key permissions for Django REST Framework
https://florimondmanca.github.io/djangorestframework-api-key/
MIT License
669 stars 103 forks source link

About second to permission check #252

Closed skybrd closed 12 months ago

skybrd commented 12 months ago

Describe the bug API request with enabled auth permission_classes = [HasAPIKey] process about a second, without - 14 ms

To Reproduce Steps to reproduce the behavior:

  1. pip install "djangorestframework-api-key==2.3.0"
  2. Configure (as in the documentation)
  3. Add permission_classes = [HasAPIKey] to ViewSet class API handler
  4. See result

Expected behavior Expected to work without significant delays.

Desktop (please complete the following information):

How did I fix it As a quick solution, I removed the recursive call in models.py, class BaseAPIKeyManager - method get_from_key call is_valid and vice versa. Perhaps it was a mistake - now all works correct, the request is processed in 14 ms

    def get_from_key(self, key: str) -> "AbstractAPIKey":
        prefix, _, _ = key.partition(".")
        queryset = self.get_usable_keys()

        try:
            api_key = queryset.get(prefix=prefix)
        except self.model.DoesNotExist:
            raise  # For the sake of being explicit.

        # if not api_key.is_valid(key):
        #     raise self.model.DoesNotExist("Key is not valid.")
        # else:
        return api_key
florimondmanca commented 12 months ago

@skybrd Hi

If I’m correct, this relates to #173 which as been dealt with, the fix should be released soon — see #248.

I am closing this for now but if you think this will not be fixed by the pending fix, we can discuss further.

thanks!