tomchristie/django-rest-framework — pull request #399 by robromano (2012-11-11 00:32:14+00:00)
Title: Added login and logout views and urlpatterns for users of TokenAuthentication

Tom,

Here's my attempt at writing an auth-token/login and auth-token/logout views to support scripted logins using TokenAuthentication, as you suggested in the forum.

The approach I took was to treat the 'login' one as a REST endpoint in itself, accepting POST with a CreateAPIView class view and a serializer for validating the input. The logout view is simpler, just a POST to a URL that deletes the token associated with the authenticated request (otherwise does nothing).

I wrote unittests for both logout/login.

I had started off with a regular Django login() view that created the token using request.POST['username'] and request.POST['password'] from a form, but I figured why not use the framework itself and support JSON and form POSTs, etc.? However, the logout view is not rest_framework based. Is this strange?

I'm new to rest_framework, so regardless of this pull request, I'd be interested to know if the view & serializer I wrote is good or could be simplified more. Is it right to re-use the serializer to convert from 'username' + 'password' inputs into a JSON { 'token' : , 'user' : } representation? Should we just do regular Django login/logout views instead?

This is my first pull request ever. Appreciate any feedback or comments on what I'm doing right or wrong. Sorry the change was accidentally split into 2 commits.