def dispatch(self, request, *args, **kwargs):"""`.dispatch()` is pretty much the same as Django's regular dispatch,but with extra hooks for startup, finalize, and exception handling."""self.args = argsself.kwargs = kwargs第一步：对request进行加工（添加数据）request = self.initialize_request(request, *args, **kwargs)self.request = requestself.headers = self.default_response_headers  # deprecate?try:#第二步：#处理版权信息#认证#权限#请求用户进行访问频率的限制self.initial(request, *args, **kwargs)# Get the appropriate handler methodif request.method.lower() in self.http_method_names:handler = getattr(self, request.method.lower(),self.http_method_not_allowed)else:handler = self.http_method_not_allowed# 第三步、执行：get/post/put/delete函数response = handler(request, *args, **kwargs)except Exception as exc:response = self.handle_exception(exc)#第四步、 对返回结果再次进行加工self.response = self.finalize_response(request, response, *args, **kwargs)return self.response

    def initialize_request(self, request, *args, **kwargs):"""Returns the initial request object."""#把请求弄成一个字典返回了parser_context = self.get_parser_context(request)return Request(request,parsers=self.get_parsers(),  #解析数据，默认的有三种方式，可点进去看#self.get_authenticator优先找自己的，没有就找父类的authenticators=self.get_authenticators(), #获取认证相关的所有类并实例化，传入request对象供Request使用negotiator=self.get_content_negotiator(),parser_context=parser_context)

    def get_authenticators(self):"""Instantiates and returns the list of authenticators that this view can use."""#返回的是对象列表return [auth() for auth in self.authentication_classes]  #[SessionAuthentication,BaseAuthentication]

authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES  #默认的，如果自定制了会优先执行自定制的

api_settings = APISettings(None, DEFAULTS, IMPORT_STRINGS)  #点击继承的DEFAULTS类

DEFAULTS = {# Base API policies'DEFAULT_AUTHENTICATION_CLASSES': ('rest_framework.authentication.SessionAuthentication',   #这时候就找到了他默认认证的类了，可以导入看看'rest_framework.authentication.BasicAuthentication'),

from rest_framework.authentication import SessionAuthentication
from rest_framework.authentication import BaseAuthentication

class BaseAuthentication(object):"""All authentication classes should extend BaseAuthentication."""def authenticate(self, request):"""Authenticate the request and return a two-tuple of (user, token)."""raise NotImplementedError(".authenticate() must be overridden.")def authenticate_header(self, request):"""Return a string to be used as the value of the `WWW-Authenticate`header in a `401 Unauthenticated` response, or `None` if theauthentication scheme should return `403 Permission Denied` responses."""pass

class BasicAuthentication(BaseAuthentication):"""HTTP Basic authentication against username/password."""www_authenticate_realm = 'api'def authenticate(self, request):"""Returns a `User` if a correct username and password have been suppliedusing HTTP Basic authentication.  Otherwise returns `None`."""auth = get_authorization_header(request).split()if not auth or auth[0].lower() != b'basic':return None   #返回none不处理。让下一个处理if len(auth) == 1:msg = _('Invalid basic header. No credentials provided.')raise exceptions.AuthenticationFailed(msg)elif len(auth) > 2:msg = _('Invalid basic header. Credentials string should not contain spaces.')raise exceptions.AuthenticationFailed(msg)try:auth_parts = base64.b64decode(auth[1]).decode(HTTP_HEADER_ENCODING).partition(':')   #用partition切割，保留了分割项冒号except (TypeError, UnicodeDecodeError, binascii.Error):msg = _('Invalid basic header. Credentials not correctly base64 encoded.')raise exceptions.AuthenticationFailed(msg)userid, password = auth_parts[0], auth_parts[2]  # 返回用户和密码return self.authenticate_credentials(userid, password, request)def authenticate_credentials(self, userid, password, request=None):"""Authenticate the userid and password against username and passwordwith optional request for context."""credentials = {get_user_model().USERNAME_FIELD: userid,'password': password}user = authenticate(request=request, **credentials)if user is None:raise exceptions.AuthenticationFailed(_('Invalid username/password.'))if not user.is_active:raise exceptions.AuthenticationFailed(_('User inactive or deleted.'))return (user, None)def authenticate_header(self, request):return 'Basic realm="%s"' % self.www_authenticate_realm

    def initial(self, request, *args, **kwargs):"""Runs anything that needs to occur prior to calling the method handler."""self.format_kwarg = self.get_format_suffix(**kwargs)# Perform content negotiation and store the accepted info on the requestneg = self.perform_content_negotiation(request)request.accepted_renderer, request.accepted_media_type = neg# Determine the API version, if versioning is in use.#2.1 处理版本信息version, scheme = self.determine_version(request, *args, **kwargs)request.version, request.versioning_scheme = version, scheme# Ensure that the incoming request is permitted#2.2 认证
        self.perform_authentication(request)# 2.3 权限
        self.check_permissions(request)# 2.4 请求用户进行访问频率的限制self.check_throttles(request)

    def perform_authentication(self, request):"""Perform authentication on the incoming request.Note that if you override this and simply 'pass', then authenticationwill instead be performed lazily, the first time either`request.user` or `request.auth` is accessed."""request.user   #执行request的user，这是的request已经是加工后的request了

from rest_framework.views import Request

    @propertydef user(self):"""Returns the user associated with the current request, as authenticatedby the authentication classes provided to the request."""if not hasattr(self, '_user'):with wrap_attributeerrors():self._authenticate()  #return self._user  #返回user

 def _authenticate(self):"""Attempt to authenticate the request using each authentication instancein turn."""#循环对象列表for authenticator in self.authenticators:try:#执行每一个对象的authenticate 方法user_auth_tuple = authenticator.authenticate(self)   except exceptions.APIException:self._not_authenticated()raiseif user_auth_tuple is not None:self._authenticator = authenticatorself.user, self.auth = user_auth_tuple  #返回一个元组，user，和auth，赋给了self,# 只要实例化Request，就会有一个request对象，就可以request.user,request.auth了returnself._not_authenticated()

 def _not_authenticated(self):"""Set authenticator, user & authtoken representing an unauthenticated request.Defaults are None, AnonymousUser & None."""#如果跳过了所有认证，默认用户和Token和使用配置文件进行设置self._authenticator = None  #
if api_settings.UNAUTHENTICATED_USER:self.user = api_settings.UNAUTHENTICATED_USER() # 默认值为：匿名用户AnonymousUserelse:self.user = None  # None 表示跳过该认证if api_settings.UNAUTHENTICATED_TOKEN:self.auth = api_settings.UNAUTHENTICATED_TOKEN()  # 默认值为：Noneelse:self.auth = None# (user, token)# 表示验证通过并设置用户名和Token；# AuthenticationFailed异常