Package: drf-tmp-scoped-token
rest_framework_tmp_scoped_tokenprovides a Django REST
Framework-compatible system to generate and validate signed
authorization tokens. Generated tokens contain the ID of a user on whose
behalf the token bearer authenticates, a white-list of HTTP verbs and
API endpoints that the bearer is permitted to access, an max-lifespan of
the token, and a note about the intended recipient.UsageAuthorizationAddrest_framework_tmp_scoped_token.TokenAuthto theDEFAULT_AUTHENTICATION_CLASSESsection of yourREST_FRAMEWORKsettings insettings.py:REST_FRAMEWORK={'DEFAULT_AUTHENTICATION_CLASSES':(# ... Your other forms of auth'rest_framework_tmp_scoped_token.TokenAuth',)}To authenticate with an temporary permissions token, make a request with
the token included in either:theAuthorizationHTTP header with aTmpTokenkeyword:Authorization: TmpToken eyJzb21ldGhpbmctc2VjcmV0IjoiaG9wZSBub2JvZHkgc2VlcyB0aGlzIn0:1d47N6:woJG0EgLNDb0OjYQmCbsjniP-2YaTOKENGETquery parameter:/api/?TOKEN=eyJzb21ldGhpbmctc2VjcmV0IjoiaG9wZSBub2JvZHkgc2VlcyB0aGlzIn0:1d47N6:woJG0EgLNDb0OjYQmCbsjniP-2YIf you would like to customize either theAuthorizationheader
keyword or theGETquery parameter used, you can subclass therest_framework_tmp_scoped_token.TokenAuthclass and override thekeywordorget_paramvalues.TokenTo generate a token, use therest_framework_tmp_scoped_token.TokenManagerclass. The token
encompasses the following information:user: User that will be authenticated by token.endpoints: key:value pairs of HTTP methods and endpoint roots
that token is authorized to access. The following values would
authorize the token to make GET requests to any endpoints that begin
with ‘api/v1/foo:{'GET':['/api/v1/foo']}NOTE: This this token will not override any existing permissions
for its associatted User within the system. It only adds further
restrictions to the endpoints that can be accessed.max_age: How long, in seconds, the token will be valid. By
default, tokens will be valid for 1 hour. Non-expiring tokens are not
supported.recipient:(Optional)A textual description of the recipient
for which this token was intended. No validation is done with this
data, however it is appended to the request as aX-API-Token-Recipientheader by the accompanying DRF
authentication scheme. This is for tracking purposesNOTE: The tokens are signed via Django’s`signing<https://docs.djangoproject.com/en/dev/topics/signing/>`__
facility. It is important to know that thetokens are not encrypted,
they are simply signed. For this reason, you should not include any
sensitive/secret information in the tokens. For an example, notice how
easy it is to view the contents of a signed string:In[1]:fromdjango.coreimportsigningIn[2]:t=signing.dumps({'something-secret':'hope nobody sees this'})In[3]:print(t)eyJzb21ldGhpbmctc2VjcmV0IjoiaG9wZSBub2JvZHkgc2VlcyB0aGlzIn0:1d47N6:woJG0EgLNDb0OjYQmCbsjniP-2YIn[4]:importbase64In[5]:print(base64.urlsafe_b64decode(t.encode('utf8')))b'{"something-secret":"hope nobody sees this"}5w\x8e\xcd\xeb\n\t\x1bA ,\xd0\xdb\xd0\xe8\xd8B`\x9b\xb29\xe2?\xed\x98'ContributingTestingpipinstall-rrequirements-test.txt./runtestsDeployingpipinstall-rrequirements-deploy.txtpythonsetup.pytestcleanbuildtagpublish