tomchristie/django-rest-framework — pull request #1382 by mking (2014-02-01 22:07:48+00:00)
Title: Generate random token directly

This improves token generation in two ways:
- The use of HMAC doesn't appear to add any security. Normally, HMAC is used to sign some content, but in this case, the content being signed is the empty string.
- The use of uuid4 unnecessarily restricts the size of the auth token. This implementation uses 40 bytes to keep the token compatible, but opens up the possibility of increasing security later.

Current implementation:
- Generate the random bytes using uuid
- Convert to hex using hmac

Implementation in this pull request:
- Generate the random bytes using urandom ([the backend for uuid4](https://github.com/python-git/python/blob/master/Lib/uuid.py#L527))
- Convert to hex using hexlify