djangorestframework-jwt 1.1.1

Overview

This package provides JSON Web Token Authentication support for Django REST framework.

If you want to read more about JWT, here’s a great blog post by the guys at Auth0 that talks about Cookie vs Token based authentication.

Requirements

• Python (2.7, 3.2, 3.3, 3.4)

• Django (1.6, 1.7)

• Django REST Framework (2.4.3, 2.4.4, 3.0.0)

Installation

Install using pip…

$ pip install djangorestframework-jwt

Usage

In your settings.py, add JSONWebTokenAuthentication to Django REST framework’s DEFAULT_AUTHENTICATION_CLASSES.

REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
    ),
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.SessionAuthentication',
        'rest_framework.authentication.BasicAuthentication',
        'rest_framework_jwt.authentication.JSONWebTokenAuthentication',
    ),
}

In your urls.py add the following URL route to enable obtaining a token via a POST included the user’s username and password.

urlpatterns = patterns(
    '',
    # ...

    url(r'^api-token-auth/', 'rest_framework_jwt.views.obtain_jwt_token'),
)

You can easily test if the endpoint is working by doing the following in your terminal, if you had a user created with the username admin and password abc123.

$ curl -X POST -d "username=admin&password=abc123" http://localhost:8000/api-token-auth/

Alternatively, you can use all the content types supported by the Django REST framework to obtain the auth token. For example:

$ curl -X POST -H "Content-Type: application/json" -d '{"username":"admin","password":"abc123"}' http://localhost:8000/api-token-auth/

Now in order to access protected api urls you must include the Authorization: JWT <your_token> header.

$ curl -H "Authorization: JWT <your_token>" http://localhost:8000/protected-url/

Refresh Token

If JWT_ALLOW_REFRESH is True, issued tokens can be “refreshed” to obtain a new brand token with renewed expiration time. Add a URL pattern like this:

url(r'^api-token-refresh/', 'rest_framework_jwt.views.refresh_jwt_token'),

Pass in an existing token to the refresh endpoint as follows: {"token": EXISTING_TOKEN}. Note that only non-expired tokens will work. The JSON response looks the same as the normal obtain token endpoint {"token": NEW_TOKEN}.

```bash $ curl -X POST -H “Content-Type: application/json” -d ’{“token”