Package: django-rest-authtoken
django-rest-authtokenA simple token-based authentication backend for Django Rest Framework that stores cryptographically hashed tokens on the server-side. Unlike the upstream auth token implementation of Django Rest Framework, each login generates a new unique token, providing the ability to revoke (or log out) individual sessions rather than all at onces.
Furthermore, only cryptographically hashed values of the tokens are stored on the server, thus a leak of the server-side auth token table does not allow an attacker to use any authenticated sessions.InstallationThis package can be installed viapip:pipinstalldjango-rest-authtokenTo use it, add it toINSTALLED_APPSin the Django settings:INSTALLED_APPS=[...'rest_authtoken',...]In addition, the package's urls need to be added to the main urlconf:urlpatterns=[...,path('auth/',include('rest_authtoken.urls')),...,]This will add the URLs/auth/login/,/auth/logout/,/auth/register/(if registration is enabled), and/auth/register/confirm/<token:str>(if registration and email confirmation are enabled).To allow authentication using anAuthorization: Token XXXXHTTP header, the following configuration is required:REST_FRAMEWORK={'DEFAULT_AUTHENTICATION_CLASSES':('rest_authtoken.auth.AuthTokenAuthentication',),}Usage ExamplesLoginLogin:curlhttp://127.0.0.1:8000/auth/login/--data'username=john&password=foobar123'-v
...
<HTTP/1.1200OK
...{"token":"As3pLIG8WeltLyZxoRcjQqu7wqPXhzFOMuxqFJjXa-Pb4tIMpzh-Ti21Nah4r38P"}Login (with specifiedUSER_SERIALIZER):curlhttp://127.0.0.1:8000/auth/login/--data'username=john&password=foobar123'-v
...
<HTTP/1.1200OK
...{"token":"As3pLIG8WeltLyZxoRcjQqu7wqPXhzFOMuxqFJjXa-Pb4tIMpzh-Ti21Nah4r38P","user":{"id":3,"username":"john"}}The supplied token has to be added to all further API requests in theAuthorizationHTTP header.Logoutcurlhttp://127.0.0.1:8000/auth/logout/-v-H'Authorization: Token As3pLIG8WeltLyZxoRcjQqu7wqPXhzFOMuxqFJjXa-Pb4tIMpzh-Ti21Nah4r38P'-XDELETE
...
>Authorization:Tokeng8txWxa2N-u97E-VD2E6SPozZWLLePxeLHu1FsXo3J6HZx1o7ldLkQ-kosk0Vgq6
...
<HTTP/1.1204NoContentRegistrationRegistration (with disabled email confirmation):curlhttp://127.0.0.1:8000/auth/register/--data'username=john&password=foobar123'-v
...
<HTTP/1.1201Created
...{"success":true}If the user exists already:curlhttp://127.0.0.1:8000/auth/register/--data'username=john&password=foobar123'-v
...
<HTTP/1.1400BadRequest
...{"username":["A user with that username already exists."]}User SerializerAn optional user serializer can be specified in the settings. If specified, auserattribute will be included in successful authentication responses containing the serialized authenticated user. Settings example:USER_SERIALIZER='user.serializers.OwnUserSerializer'RegistrationThe registration is disabled by default. To enable it, the following value is required in the Django settings:REGISTRATION_ENABLED=TrueCase-Insensitive UsernamesTo make usernames case-insensitive (and thus, prevent the registration of multiple identical usernames with different cases), you could overwrite theget_by_natural_keyto search for existing usernames case-insensitively:classCustomUserManager(UserManager):defget_by_natural_key(self,username):username_attr='{}__iexact'.format(self.model.USERNAME_FIELD)returnself.get(**{username_attr:username})classUser(AbstractUser):...objects=CustomUserManager()...django-rest-authtokenuses theget_by_natural_keymethod upon registration to verify the uniqueness of the username.Confirmation EmailIt is possible to optionally enable an email confirmation. An email will be sent upon registration to the provided email address. For this to work, the user model needs to contain aBooleanFieldthat stores whether the email address has been confirmed already. If email confirmation should be mandatory to be able to login, this can be set to theactivefield of the user (which is respected by django-rest-authtoken upon login).A minimal example of a compatible user model could look like this:classUser(AbstractUser):email_confirmed=models.BooleanField(default=False)Warning:Remember to reset the value of this field toFalsewhen the email address is changed. This could be achieved by adding the following methods to the user model (keep in mind that this does not catch all cases, for example if using theQuerySet'supdate()method, or whenupdate_fieldsare specified):def__init__(self,*args,**kwargs):super().__init__(*args,**kwargs)self._initial_email=self.emaildefsave(self,*args,**kwargs):ifself.email!=self._initial_email:self.email_confirmed=Falsesuper().save(*args,**kwargs)In the Django settings file, the following configuration is required:REGISTRATION_EMAIL_CONFIRM=TrueREGISTRATION_EMAIL_CONFIRM_MODEL_FIELD='email_confirmed'REGISTRATION_EMAIL_CONFIRM_TOKEN_VALIDITY=timedelta(days=1)REGISTRATION_EMAIL={'BASE_URL':'https://your-super-service.example.org',# without trailing slash'FROM':'noreply@example.org','SUBJECT':'Confirm your email address for FOOBAR','MESSAGE':'''Hello{username},please visit the following link to confirm your email address:{url}''',}TheMESSAGEattribute is formatted using the Pythonformatfunction, supplying ausernameand aurlvalue. The URL is built based on the suppliedBASE_URLvalue in theREGISTRATION_EMAILsetting.For internationalization, lazy translation methods (e. g.,gettext_lazy) can be used. Strings will be translated to the language of the request which causes the email to be sent (if it is triggered by a request).To send a confirmation email to a user,send_confirmation_email(user: get_user_model())fromrest_authtoken.email_confirmationcan be called with the user object as argument.Upon successful confirmation, the user is redirected to the path/. This can be changed by setting the variableREGISTRATION_CONFIRM_REDIRECT_PATHto a different path in the settings.
If the provided token is invalid or expired, the user can be redirected to a path by settingREGISTRATION_CONFIRM_INVALID_REDIRECT_PATH. If the value is not specified, a 400 Bad Request is returned with a short and generic (plain-text and unformatted) error message.Be careful:These paths are not checked. You can configure absolute URLs to other domains as well. Make sure not to set this setting to any untrusted value.Manual Confirmation Emails From Django AdminIf you are using the Django admin app, you can define an action for your user model to manually (re)send confirmation emails to users by defining the following action and supplying it to theModelAdmin(make sure to adapt the field names etc. to your own values):defsend_confirmation_emails(modeladmin,request,queryset):foruserinqueryset.filter(email_confirmed=False):send_confirmation_email(user)@admin.register(User)classOwnUserAdmin(UserAdmin):...actions=[send_confirmation_emails]...Attention:This action may raise ansmtplib.SMTPExceptionfor any of the supplied users, not sending any confirmation mails to users that would have been processed later.