python - How do I create a login API using Django Rest Framework?

74
votes

I want to create a login api (or use an existing one if it is already pre-bundled) using django rest framework. However, I'm completely at a loss. Whenever I send a post request to the django rest framework "login" url, it just sends back the browsable api template page...

MY CONFIGURATION

urls.py

url(r'^api/v1/', include('rest_framework.urls', namespace='rest_framework'))

settings.py

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.BasicAuthentication',
        'rest_framework.authentication.SessionAuthentication',
    )
}

WHAT I WANT

Request: 

POST /api/v1/login  username='name' pass='pass'

Response: 

200 OK "{username: 'name', 'userId': '54321'}" set-cookie: sessionid="blahblah"
4
pythondjangorestdjango-rest-framework
I am planning to just roll out the api using https and basic auth. But does the browser have a secure way of storing the auth credentials? I don't want the users to have to constantly re-login if they browse away and then browse back to my site. I want to do away with session authentication because of csrf tokens... They are brutal to manage in an API. I want to have my cake and eat it to... - JayPrime2012
Assuming the browser offers a persistent storage binned by domain that only the owner domain can access, I think I could just store session id in the persistent storage and not in the cookie to prevent CSRF vulnerabilities in my API based website. - JayPrime2012
Did you find out how to do it? - jul
For future readers, I made a tutorial on the subject: michaelwashburnjr.com/django-user-authentication - mdw7326
@mdw7326, "Page not found." it's for your tutorial - Vadim

4 Answers

38
votes

Take a look at the api view from django-rest-framework-jwt. It's an implementation for creating auth tokens rather than cookie sessions, but your implementation will be similar. See views.py and serializers.py. You can probably use the serializers.py unchanged, and just adjust your views to return the right parameters and possibly set the session cookie (can't recall if that's already performed in authentication).

15
votes

If you want something like this I do the same thing however I use Token authentication.

Check out their token page here

This may not be what you want but the way I do it is (since I'm using it as a rest api endpoints for mobile clients)

I can do my url localhost:8000/api/users/ -H Authorization : Token A browser could then use the regular login page that you create at the provided rest framework url

url(r'^api-auth/', include('rest_framework.urls', namespace='rest_framework')

and to get tokens for 'login-less' navigation

url(r'^api-token-auth/', 'rest_framework.authtoken.views.obtain_auth_token')

Then if you make calls and such you can pass the authorization tokens. Of course this is just how I do it and it's probably not the most efficient way but my goal was to create a way that I can provide users with session authentication for browsers and mobile access via tokens.

Then in your views.py make sure you add the authentication requirements for that view. Almost the same as session authentication section

permission_classes = (permissions.IsAdminUser,)

but also include

authentication_classes = (authentication.TokenAuthentication,)

I hope this helps but if not, good luck on your search.

14
votes

Of course token is a good way to authenticate, but questioner is asking about session authentication.

Request:

POST /api/v1/login  username='username' password='password'
  • Put csrftoken value at X-CSRFToken in header
  • Even though someone using email as username filed, username name parameter is required for email input (e.g. username='[email protected]')

Response:

302 FOUND sessionid="blahblah"
  • If you not specified next value, it will automatically redirect into /accounts/profile/ which can yield 404 error
1
votes

Adding our views:

from rest_framework_jwt.views import refresh_jwt_token

urlpatterns = [
    ...
    url(r'^rest-auth/', include('rest_auth.urls')),
    url(r'^rest-auth/registration/', include('rest_auth.registration.urls')),
    ...
    url(r'^refresh-token/', refresh_jwt_token),
]