mozilla/kitsune — pull request #2099 by mythmon (2014-09-04 00:52:07+00:00)
Title: [Bug 1062401] API authentication

This does a few things

* Bring in the DRF token authentication backend
* Expose an endpoint to get tokens to use with that backend.
* Add an endpoint to test any authentication method (of which we only have the token one for now)
* Add a cron job which runs once per day to clear out tokens that are more than 30 days old.
* Some style changes.

The DRF endpoint to give tokens to users if they give a username and password. For example

```bash
$ curl -XPOST http://kitsune/api/1/users/get_token \
-d username=mythmon -d password=testpass
{"token": "d6f449d8b3ebcc830ca226fb28bc85d4f4c703b1"}
```

This token can then be used to authenticate via the "Authorization" HTTP header:
```bash
$ curl http://kitsune/api/1/users/test_auth \
-H 'Authorization: Token d6f449d8b3ebcc830ca226fb28bc85d4f4c703b1'
{"username": "mythmon", "authorized": true}
```

Invalid tokens will give an error
```bash
$ curl http://kitsune/api/1/users/test_auth -i -H 'Authorization: Token lol'
HTTP/1.1 401 UNAUTHORIZED
Content-Type: application/json; charset=utf-8
Allow: OPTIONS, GET
WWW-Authenticate: Basic realm="api"

{"detail": "Invalid token"}
```