JWT的生成与校验核心是一个无状态的交互流程。服务器生成令牌后客户端在后续请求中携带它服务器只需验证令牌本身即可无需保存会话状态。jwt 的交互流程如下。Python 生成和校验 jwt 的常用方式有下面这几种。itsdangerous可以生成包含时间戳、对 URL 安全的签名令牌。一般用于生成轻量的非标准的 API 认证令牌。import uuid import secrets from itsdangerous.url_safe import URLSafeTimedSerializer as Serializer def generate_secret_key(): secret_key secrets.token_hex(32) print(fsecret_key: {secret_key}) return secret_key def generate_access_token(): access_token uuid.uuid1().hex print(faccess_token: {access_token}) return access_token SECRET_KEY generate_secret_key() ACCESS_TOKEN generate_access_token() def encode_jwt(access_token): jwt Serializer(secret_keySECRET_KEY) return jwt.dumps(access_token) def decode_jwt(jwt_token): jwt Serializer(secret_keySECRET_KEY) payload jwt.loads(jwt_token) return payload if __name__ __main__: payload {user_id: ACCESS_TOKEN, username: Looking} auth_token encode_jwt(payload) print(fauth_token: {auth_token}) payload decode_jwt(auth_token) print(fpayload: {payload})secret_key: 2bcc46556f275ef90edf09104829aef4c2a8fd1c0f4d0c83d34e96b552518295 access_token: b6065d22a51711f1bbc2489ebd2d776f auth_token: eyJ1c2VyX2lkIjoiYjYwNjVkMjJhNTE3MTFmMWJiYzI0ODllYmQyZDc3NmYiLCJ1c2VybmFtZSI6Ikxvb2tpbmcifQ.apU-JA.gjI87rWbCsIlQ2R-goAZOdDhJ5o payload: {user_id: b6065d22a51711f1bbc2489ebd2d776f, username: Looking}PYJWT目前最核心、最流行的 JWT 库它提供了最基础的生成与验证功能是其他许多库的底层依赖。import jwt import uuid import secrets def generate_secret_key(): secret_key secrets.token_hex(32) print(fsecret_key: {secret_key}) return secret_key def generate_access_token(): access_token uuid.uuid1().hex print(faccess_token: {access_token}) return access_token SECRET_KEY generate_secret_key() ACCESS_TOKEN generate_access_token() def encode_jwt(payload): token jwt.encode(payload, SECRET_KEY, algorithmHS256) return token def decode_jwt(jwt_token): payload jwt.decode(jwt_token, SECRET_KEY, algorithms[HS256]) return payload if __name__ __main__: payload {user_id: ACCESS_TOKEN, username: Looking} auth_token encode_jwt(payload) print(fauth_token: {auth_token}) payload decode_jwt(auth_token) print(fpayload: {payload})secret_key: b56c0da985b4b5f0cecda3dce931ea1bec0340c6e0494cd280f20076acd91695 access_token: 52776fe6a51311f195a1489ebd2d776f auth_token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoiNTI3NzZmZTZhNTEzMTFmMTk1YTE0ODllYmQyZDc3NmYiLCJ1c2VybmFtZSI6Ikxvb2tpbmcifQ.ycHmDEYoXbIIZIwFXasVMTDW2ELzcp118YMJvW6xKao payload: {user_id: 52776fe6a51311f195a1489ebd2d776f, username: Looking}