Package: django-jwt-auth-middleware
Django JWT Auth MiddlwareInstallationAdd the configuration fordjango_jwt_auth_middlewareto your settings as follows:INSTALLED_APPS=[# ...,"django_jwt_auth_middlware",# ...,]# ...AUTHENTICATION_BACKENDS=["django.contrib.auth.backends.ModelBackend",# default"django_jwt_auth_middleware.auth.JWTAuthenticationBackend",]# ...# the middleware must go after django's SecurityMiddleware, SessionMiddleware,# and AuthenticationMiddleware. Putting it at the end is always safe.MIDDLEWARE=[# ...,"django_jwt_auth_middleware.auth.JWTAuthenticationMiddleware",]If you wish to use the default URL paths (/jwt/...), then inurls.py, make the changes below. Alternatively, you can import the viewsLogin,Logout, andRefreshviews (class-based) directly and attach URL patterns to them however you wish.NOTE:the default paths do not have URL names specified for referencing.# using default pathsfromdjango_jwt_auth_middleware.urlsimporturlpatternsasjwt_auth_patternsfromdjango.urlsimportpath,includeurlpatterns=[# ...,path('',include(jwt_auth_patterns))]# using custom pathsfromdjango_jwt_auth_middleware.viewsimportLogin,Logout,Refreshurlpatterns=[# ...,path('login/',Login.as_view(),name='login'),path('logout/',Logout.as_view(),name='logout'),path('refresh/',Refresh.as_view(),name='refresh'),]You're now ready to start authenticating!UsageThis section assumes you have at least one user defined for your application.LoginIn order to log in, send a POST request to the associated view (default:/jwt/login/) with the POST body specifying two keys:username, andpassword. If the username and password authenticate successfully, then a token will be issued and stored in the client's browser containing the valueBearer <tok>and a200is returned, where<tok>here is the JWT that corresponds to the newly authenticated user. If the provided credentials do not match, a400is returned. The cookie name/header value that is used for the JWT corresponds to theJWT_ACCESS_HEADERsetting (default:Authorization).RefreshThis package is intended to implement best practices for JWT authentication and this includes utilizing two separate tokens, refresh and access, which are both issued during login. The access token is sent on every request and lasts only a short time and is used to identify the client to the server. The refresh token is sent only occasionally to acquire a new access token.In order to refresh the access token, send a POST request to the associated view (default:/jwt/refresh/) with an empty POST body. As long as a valid refresh token exists in the browser, a new access token will be generated and stored securely in the browser. If a token is generated, a200is returned, otherwise a403is returned.LogoutWhen utilizing JWT authentication, logout is functionally identically to forgetting the refresh token (and potentially also the access token, but that will expire shortly anyway so the necessity of this depends on your threat model). By default the logout functionality removes both the access and refresh tokens. To perform the logout, simply send a POST request to the associated view (default:/jwt/logout/) with an empty POST body. As long as a valid access token exists in the browser, the client will be logged out. If the log out is successful, a200is returned, otherwise a401is returned.ConfigurationA list of Django settings are provided here that describes the configuration options for this package.SETTINGDEFAULTDESCRIPTIONJWT_ACCESS_DURATION5The duration in minutes that access tokens should remain valid after they are issued.JWT_ACCESS_HEADER"Authorization"The name of the header that should be used for storing the access token. NOTE: If referencing this value withinrequest.META, the header is prefixed withHTTP_and is in all caps (e.g.HTTP_AUTHORIZATION)JWT_ALGORITHM"HS256"The algorithm to use for signing the JWTs.JWT_COOKIE_HTTPONLYTrueWhether or not thehttponlyattribute should be set on the cookies stored in the browser. NOTE: if testing withPostman, disable this value in development or this package won't function correctly.JWT_COOKIE_SAMESITE"Strict"What thesamesiteattribute of the cookies should be set to. Options are"Strict"or"Lax".JWT_COOKIE_SECURETrueWhether or not thesecureattribute should be set on the cookies stored in the browser. NOTE: if testing withPostman, disable this value in development or this package won't function correctly.JWT_LOGOUT_ACCESSTrueWhether or not to remove the access token when logging out. If this is set toFalse, only the refresh token is removed and user access will continue until the access token expires.JWT_REFRESH_DURATION14The duration in days that refresh tokens should remain valid after they are issued.JWT_REFRESH_PATH"/jwt/refresh/"Thepathattribute that is set on the refresh token cookies. The controls when the cookies is sent. If the path is not a prefix of the current request, the browser won't send the token. This helps prevent the refresh token from being leaked.