**Course Title:** Mastering Django Framework: Building Scalable Web Applications **Section Title:** Building RESTful APIs with Django REST Framework **Topic:** Handling authentication for APIs (Token Authentication, JWT) As we continue to build scalable web applications with Django, it's essential to ensure that our APIs are secure and authenticated. In this topic, we'll explore two popular authentication methods for APIs: Token Authentication and JSON Web Tokens (JWT). ### Token Authentication Token Authentication is a widely used method for authenticating API requests. The basic idea is that a client sends a username and password to the server, which then returns a token that can be used to authenticate subsequent requests. #### How Token Authentication Works 1. The client sends a POST request to the server with the username and password. 2. The server verifies the credentials and returns a token if they are valid. 3. The client stores the token and includes it in the `Authorization` header of subsequent requests. 4. The server verifies the token and grants access to the requested resource if it's valid. #### Implementing Token Authentication with Django REST Framework To implement Token Authentication with Django REST Framework, you'll need to: 1. Install the `rest_framework.authtoken` app by running `pip install djangorestframework-authtoken`. 2. Add `'rest_framework.authtoken'` to your `INSTALLED_APPS` setting. 3. Create a new view that handles token authentication by inheriting from `rest_framework.authtoken.views.ObtainAuthToken`. 4. Create a new serializer that handles token authentication by inheriting from `rest_framework.authtoken.serializers.AuthTokenSerializer`. Here's an example implementation: ```python # settings.py INSTALLED_APPS = [ # ... 'rest_framework.authtoken', # ... ] # views.py from rest_framework.authtoken.views import ObtainAuthToken from rest_framework.authtoken.serializers import AuthTokenSerializer class CustomAuthToken(ObtainAuthToken): def post(self, request, *args, **kwargs): serializer = AuthTokenSerializer(data=request.data) serializer.is_valid(raise_exception=True) user = serializer.validated_data['user'] token, created = Token.objects.get_or_create(user=user) return Response({ 'token': token.key, }) # urls.py from django.urls import path from .views import CustomAuthToken urlpatterns = [ path('login/', CustomAuthToken.as_view()), ] ``` ### JSON Web Tokens (JWT) JSON Web Tokens (JWT) is another popular method for authenticating API requests. JWT is a self-contained token that contains a payload with user information and a signature that can be verified by the server. #### How JWT Works 1. The client sends a POST request to the server with the username and password. 2. The server verifies the credentials and generates a JWT token that contains the user information. 3. The client stores the JWT token and includes it in the `Authorization` header of subsequent requests. 4. The server verifies the JWT token by checking the signature and payload. #### Implementing JWT with Django REST Framework To implement JWT with Django REST Framework, you'll need to: 1. Install the `rest_framework_simplejwt` app by running `pip install djangorestframework-simplejwt`. 2. Add `'rest_framework_simplejwt'` to your `INSTALLED_APPS` setting. 3. Create a new view that handles JWT authentication by inheriting from `rest_framework_simplejwt.views.TokenObtainPairView`. 4. Create a new serializer that handles JWT authentication by inheriting from `rest_framework_simplejwt.serializers.TokenObtainPairSerializer`. Here's an example implementation: ```python # settings.py INSTALLED_APPS = [ # ... 'rest_framework_simplejwt', # ... ] # views.py from rest_framework_simplejwt.views import TokenObtainPairView from rest_framework_simplejwt.serializers import TokenObtainPairSerializer class CustomTokenObtainPairView(TokenObtainPairView): def post(self, request, *args, **kwargs): serializer = TokenObtainPairSerializer(data=request.data) serializer.is_valid(raise_exception=True) return Response(serializer.validated_data) # urls.py from django.urls import path from .views import CustomTokenObtainPairView urlpatterns = [ path('login/', CustomTokenObtainPairView.as_view()), ] ``` ### Conclusion In this topic, we've explored two popular methods for authenticating API requests: Token Authentication and JSON Web Tokens (JWT). We've implemented both methods using Django REST Framework and provided examples of how to use them in your API. ### Best Practices * Always use HTTPS to encrypt API requests and responses. * Use a secure password hashing algorithm to store user passwords. * Use a secure token or JWT to authenticate API requests. * Implement rate limiting and IP blocking to prevent brute-force attacks. * Use a secure key to sign JWT tokens. ### Further Reading * Django REST Framework documentation: <https://www.django-rest-framework.org/> * Django REST Framework Simple JWT documentation: <https://django-rest-framework-simplejwt.readthedocs.io/en/latest/> * JSON Web Tokens (JWT) documentation: <https://jwt.io/> ### Leave a comment or ask for help if you have any questions or need further clarification on any of the topics covered in this topic.