DRF authentication (Token, JWT) in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this DRF view with TokenAuthentication?

Given the following Django REST Framework view using TokenAuthentication, what will be the HTTP status code if a request is made without any token?

Django

from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework.authentication import TokenAuthentication
from rest_framework.permissions import IsAuthenticated

class SampleView(APIView):
    authentication_classes = [TokenAuthentication]
    permission_classes = [IsAuthenticated]

    def get(self, request):
        return Response({'message': 'Success'})

A 401 Unauthorized error

B 200 OK with {'message': 'Success'}

C 403 Forbidden error

D 500 Internal Server Error

💡 Hint

Think about what happens when authentication credentials are missing.

TokenAuthentication requires a valid token in the request header. Without it, the request is not authenticated, so DRF returns a 401 Unauthorized response.

📝 Syntax

intermediate

Which option correctly configures JWT authentication in DRF settings?

In Django REST Framework, you want to enable JWT authentication using SimpleJWT. Which of the following REST_FRAMEWORK settings is correct?

A

"""
REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework.authentication.JWTAuthentication',
    ],
}
"""

B

"""
REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework_simplejwt.JWTAuthentication',
    ],
}
"""

C

"""
REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework_simplejwt.authentication.JWTAuthentication',
    ],
}
"""

D

"""
REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework_simplejwt.authentication.TokenAuthentication',
    ],
}
"""

💡 Hint

Check the full import path for JWTAuthentication in SimpleJWT.

The correct import path for JWTAuthentication in SimpleJWT is rest_framework_simplejwt.authentication.JWTAuthentication. Other options are incorrect or do not exist.

❓ state_output

advanced

What is the value of request.user after JWT authentication?

In a DRF view using JWT authentication, after a valid JWT token is provided, what is the type of request.user?

Django

from rest_framework_simplejwt.authentication import JWTAuthentication
from rest_framework.views import APIView
from rest_framework.response import Response

class MyView(APIView):
    authentication_classes = [JWTAuthentication]

    def get(self, request):
        user_type = type(request.user).__name__
        return Response({'user_type': user_type})

A "TokenUser"

B "User"

C "AnonymousUser"

D "CustomUser"

💡 Hint

Think about what Django sets as the user after successful authentication.

After JWT authentication, request.user is set to the Django User model instance representing the authenticated user, typically named 'User'.

🔧 Debug

advanced

Why does this DRF view raise an error with TokenAuthentication?

Consider this DRF view using TokenAuthentication. It raises an error when a request with a valid token is made. What is the cause?

Django

from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework.authentication import TokenAuthentication
from rest_framework.permissions import IsAuthenticated

class DebugView(APIView):
    authentication_classes = [TokenAuthentication]
    permission_classes = [IsAuthenticated]

    def get(self, request):
        token_key = request.auth.key
        return Response({'token': token_key})

A 'request.auth' is None, so accessing 'key' raises AttributeError

B 'request.auth' is a Token object, but 'key' attribute is misspelled

C 'request.auth' is a Token object, but 'key' attribute is private

D 'request.auth' is a string, so 'key' attribute does not exist

💡 Hint

Check the type of request.auth when using TokenAuthentication.

In TokenAuthentication, request.auth is the token string, not a Token object. Accessing key attribute on a string causes AttributeError.

🧠 Conceptual

expert

Which statement correctly describes JWT token refresh behavior in DRF SimpleJWT?

In Django REST Framework using SimpleJWT, which statement about the token refresh endpoint is true?

A The refresh token can be used multiple times until it expires to get new access tokens.

B The refresh token can only be used once; after refresh, it becomes invalid.

C The refresh token automatically renews itself on every access token request.

D The refresh token is the same as the access token but with a longer expiry.

💡 Hint

Think about how refresh tokens work in JWT authentication.

In SimpleJWT, the refresh token can be used multiple times until it expires to obtain new access tokens. It does not become invalid after one use.