Django Authentication and Authorization with JWT

Introduction

Django is a popular web framework used for building web applications. It provides built-in support for authentication and authorization. However, sometimes you may want to use a third-party package for authentication and authorization. In this blog post, we will discuss Django authentication and authorization using JSON Web Tokens (JWT). We will provide a step-by-step guide to implement JWT-based authentication and authorization in Django.

What is JWT?

JSON Web Tokens (JWT) is a standard for creating and verifying secure access tokens. A JWT consists of three parts: header, payload, and signature. The header contains information about the algorithm used to sign the token, the payload contains claims (i.e., information about the user), and the signature is used to verify the integrity of the token. JWT is commonly used for authentication and authorization in web applications.

How JWT-based authentication works in Django?

JWT-based authentication in Django involves the following steps:

1. The user sends their credentials (e.g., username and password) to the server.
2. The server validates the credentials and creates a JWT token.
3. The server sends the JWT token back to the client.
4. The client includes the JWT token in the Authorization header of subsequent requests.
5. The server verifies the JWT token and authenticates the user.

To implement JWT-based authentication in Django, we will use the djangorestframework-jwt package. This package provides a simple way to implement JWT-based authentication in Django.

Step 1: Install the djangorestframework-jwt package

To use the djangorestframework-jwt package, you need to install it first. You can install the package using pip:

pip install djangorestframework-jwt

Step 2: Configure JWT settings in Django settings file

Next, you need to configure the JWT settings in your Django settings file. Here is an example of JWT settings:

JWT_AUTH = {
    'JWT_ALLOW_REFRESH': True,
    'JWT_EXPIRATION_DELTA': datetime.timedelta(hours=1),
    'JWT_REFRESH_EXPIRATION_DELTA': datetime.timedelta(days=7),
    'JWT_AUTH_HEADER_PREFIX': 'Bearer',
}

In the above example, JWT_ALLOW_REFRESH is set to True, which means the JWT token can be refreshed. JWT_EXPIRATION_DELTA is set to 1 hour, which means the JWT token will expire after 1 hour. JWT_REFRESH_EXPIRATION_DELTA is set to 7 days, which means the JWT refresh token will expire after 7 days. JWT_AUTH_HEADER_PREFIX is set to ‘Bearer’, which means the JWT token will be included in the Authorization header with the ‘Bearer’ prefix.

Step 3: Create a JWT view

Next, you need to create a JWT view that will be used for authentication. Here is an example of a JWT view:

from rest_framework_jwt.views import obtain_jwt_token

urlpatterns = [
    path('api-token-auth/', obtain_jwt_token),
]

In the above example, we are using the obtain_jwt_token view provided by the djangorestframework-jwt package. This view will authenticate the user and create a JWT token.

Step 4: Protect views with JWT authentication

Finally, you need to protect the views that require authentication using JWT authentication. Here is an example of a protected view:

from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework.permissions import IsAuthenticated

class MyProtectedView(APIView):
    permission_classes = (IsAuthenticated,)

    def get(self, request):
        content = {'message': 'Hello, world!'}
        return Response(content)

In the above example, we have created a protected view called MyProtectedView. We have set the permission_classes attribute to IsAuthenticated, which means only authenticated users will be able to access this view. If a user tries to access this view without a valid JWT token, they will receive a 401 Unauthorized response.

Step 5: Refresh JWT token (Optional)

If the JWT_ALLOW_REFRESH setting is set to True, then you can refresh the JWT token using a refresh token. Here is an example of how to refresh the JWT token:

from rest_framework_jwt.views import refresh_jwt_token

urlpatterns = [
    path('api-token-refresh/', refresh_jwt_token),
]

In the above example, we are using the refresh_jwt_token view provided by the djangorestframework-jwt package. This view will refresh the JWT token using a refresh token.

Step 6: Using JWT in Frontend Applications

Once the user is authenticated and has received a JWT token, they can use it to make authenticated requests to protected endpoints. To use the JWT token in a frontend application, the token needs to be included in the headers of the request.

Here’s an example of how to include the JWT token in an Axios request:

import axios from 'axios';

const jwtToken = localStorage.getItem('jwtToken');
const headers = {
  'Content-Type': 'application/json',
  Authorization: `JWT ${jwtToken}`,
};

axios.get('/api/my-protected-view/', { headers })
  .then(response => console.log(response.data))
  .catch(error => console.log(error));

In the above example, we’re getting the JWT token from local storage and including it in the headers of the Axios request using the Authorization header with the value JWT ${jwtToken}.

If you’re using a different library or making requests with the Fetch API, the process will be similar. Simply include the JWT token in the headers of your requests using the Authorization header with the value JWT ${jwtToken}.

By using JWT-based authentication and authorization in your Django web application and including the JWT token in the headers of your frontend requests, you can create a secure and seamless user experience for your users.

Conclusion

In this blog post, we have discussed how to implement JWT-based authentication and authorization in Django. We have provided a step-by-step guide to implement JWT-based authentication and authorization in Django. By following these steps, you can easily implement JWT-based authentication and authorization in your Django web application.