Package: django-appwrite
Appwrite Middleware and Authentication for DjangoA Django package to authenticate users with Appwrite using middleware and/or Django Rest Framework (DRF) authentication classes.InstallationTo installdjango_appwrite, simply run:$pipinstalldjango-appwriteUsageMiddlewareAdddjango_appwrite.middleware.AppwriteMiddlewareto yourMIDDLEWARElist in your Django project'ssettings.pyfile. It should be placed after theAuthenticationMiddleware:MIDDLEWARE=[...,'django.contrib.auth.middleware.AuthenticationMiddleware','django_appwrite.middleware.AppwriteMiddleware',...]Django Rest Framework AuthenticationIf you're using Django Rest Framework, you can use theAppwriteAuthenticationclass.
Adddjango_appwrite.authentication.AppwriteAuthenticationto theDEFAULT_AUTHENTICATION_CLASSESin yoursettings.py:REST_FRAMEWORK={'DEFAULT_AUTHENTICATION_CLASSES':('django_appwrite.authentication.AppwriteAuthentication',...),...}ConfigurationConfigure the Appwrite client settings in your Django settings file:APPWRITE={'PROJECT_ENDPOINT':'https://example.com/v1','PROJECT_ID':'PROJECT_ID',}SettingDefaultDescriptionPROJECT_ENDPOINTThe endpoint of your Appwrite project. You can find this in the Appwrite console under Settings > General.PROJECT_IDThe ID of your Appwrite project. You can find this in the Appwrite console under Settings > General.AUTH_HEADERHTTP_AUTHORIZATIONThe header name that will be used to get the JWT from the authorization header. The value of this header should beBearer [JWT]VERIFY_EMAILFalseIf set toTrue, the middleware will check if the user's email address has been verified in Appwrite before authenticating the user. If the email address has not been verified, the user will not be authenticated.VERIFY_PHONEFalseIf set toTrue, the middleware will check if the user's phone number has been verified in Appwrite before authenticating the user. If the phone number has not been verified, the user will not be authenticated.PREFIX_EMAILThe prefix to use for the email address when checking if the user's email address has been verified. This is useful if you are integrating django_appwrite to existing projects that already have users.How it worksMiddleware:This middleware class will authorize the user by checking the JWT in the Authorization header. The JWT is obtained from the Authorization header and is then sent to the Appwrite API to verify the JWT. If the JWT is valid, the user will be authenticated.Authentication Class:When used with Django Rest Framework, the authentication class provides an additional way to authenticate users via Appwrite.Please note that this middleware is intended to be used in conjunction with the Appwrite client-side SDK to authorize users on the frontend, and does not provide any APIs for user authentication on its own.ExampleThis is an example of how you can configure your frontend to use this middleware. Note that this example uses theaxioslibrary.// axios interceptor to add jwt to the request headerimportaxiosfrom'axios';import{Client,Account}from'appwrite';constclient=newClient().setEndpoint('https://example.com/v1').setProject('PROJECT_ID')constaccount=newAccount(client);axios.interceptors.request.use(async(config)=>{// get jwt from your auth service/providerconst{jwt}=awaityourAuthService();config.headers={...config.headers,Authorization:`Bearer${jwt}`}returnconfig;});Important Note on CSRF ProtectionWhen using theAppwriteMiddleware, be aware that Django's built-in CSRF protection will expect a CSRF token for any mutating HTTP methods (like POST, PUT, DELETE, etc.). If you're using Appwrite tokens for authentication with this middleware, you might encounter CSRF validation issues, since the CSRF token might not be present or validated.If you're only using the Appwrite token for authentication, and you're confident about the origin protection measures of your front-end, you might consider exempting certain views from CSRF protection. However, do this with caution and ensure you understand the security implications. Always ensure that your application is protected against Cross-Site Request Forgery attacks.You can exempt views from CSRF protection using the@csrf_exemptdecorator or by using thecsrf_exemptfunction on specific routes in yoururls.py. However, these methods can leave your application vulnerable if used carelessly. Always prioritize the security of your application and its users.LicenseThe django-appwrite package is released under the MIT License. See the bundledLICENSEfile for details.