WiserTogether/django-token-auth — pull request #1 by bsod90 (2014-03-20 16:45:57+00:00)
Title: Token generator

Added generate and validate token methods.

Token validator and generator are the basic part of auth library.
Each token consists of two parts:
+ token content - useful payload that we need to authenticate a user
+ signature - some value that guarantees that token has been issued by somebody who knows the private key

token content:

+ token name - a string mark that identifies that it's an auth token (not email-validation, password-reset or any other kind of tokens)
+ user_id - an ID used to authenticate user
+ expiration time - time until this token is valid

all the parts are just strings joined by "::" (not just :: or . as they used in timestamp)

token signature:

I used RSA to sign the token because it's this lib is aimed to be used in many different environment (many APIs) at once and using a symmetrical shared key everywhere is risky. RSA (asymmetrical crypto algorithm) gives us a possibility to protect only a private key that should be hold by token issuer and not care at all about public key security.

path to public and private keys can be specified as DJANGO_TOKEN_AUTH_PUBLIC_KEY/DJANGO_TOKEN_AUTH_PRIVATE_KEY environment variables or
TOKEN_AUTH_PUBLIC_KEY/TOKEN_AUTH_PRIVATE_KEY settings variables.