DRF authentication (Token, JWT) in Django - Mini Project: Build & Apply

DRF Authentication with Token and JWT

📖 Scenario: You are building a simple Django REST API for a book collection app. You want to secure the API so only logged-in users can access their books. You will set up two common authentication methods: Token Authentication and JWT Authentication.

🎯 Goal: Set up Django REST Framework authentication using Token Authentication and JWT Authentication. You will create the initial project setup, configure authentication settings, implement token and JWT authentication, and complete the API views to require authentication.

📋 What You'll Learn

Create a Django project and app with Django REST Framework installed

Set up Token Authentication with DRF's built-in token system

Configure JWT Authentication using the 'djangorestframework-simplejwt' package

Protect API views so only authenticated users can access them

💡 Why This Matters

🌍 Real World

APIs often need secure authentication to protect user data. Token and JWT authentication are common methods used in real-world web applications.

💼 Career

Understanding how to implement and configure authentication in Django REST Framework is a valuable skill for backend developers working on secure APIs.

1

Create initial Django project and app

Create a Django project named bookproject and an app named books. In books/models.py, create a model called Book with fields title (CharField, max_length=100) and author (CharField, max_length=100).

Django

# Your code here to create the Django project, app, and Book model

Need a hint?

Use django-admin startproject bookproject and python manage.py startapp books to create the project and app. Then define the Book model in books/models.py.

2

Configure Token Authentication in settings

In bookproject/settings.py, add rest_framework and rest_framework.authtoken to INSTALLED_APPS. Then add a REST_FRAMEWORK setting with 'DEFAULT_AUTHENTICATION_CLASSES' set to include 'rest_framework.authentication.TokenAuthentication'.

Django

from django.db import models

class Book(models.Model):
    title = models.CharField(max_length=100)
    author = models.CharField(max_length=100)

# Add 'rest_framework' and 'rest_framework.authtoken' to INSTALLED_APPS
# Add REST_FRAMEWORK setting with TokenAuthentication
# Your code here

Need a hint?

Modify INSTALLED_APPS to include the required apps. Then add the REST_FRAMEWORK dictionary with the authentication class.

3

Add JWT Authentication configuration

Install djangorestframework-simplejwt package. In bookproject/settings.py, import timedelta from datetime. Add SimpleJWT authentication to REST_FRAMEWORK['DEFAULT_AUTHENTICATION_CLASSES']. Also add a SIMPLE_JWT dictionary with ACCESS_TOKEN_LIFETIME set to 5 minutes and REFRESH_TOKEN_LIFETIME set to 1 day.

Django

INSTALLED_APPS = [
    # other apps
    'rest_framework',
    'rest_framework.authtoken',
]

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework.authentication.TokenAuthentication',
        # Add JWT authentication here
    ],
}

# Import timedelta
# Add SIMPLE_JWT settings

from django.db import models

class Book(models.Model):
    title = models.CharField(max_length=100)
    author = models.CharField(max_length=100)

# Your code here

Need a hint?

Use pip install djangorestframework-simplejwt to install the package. Then update REST_FRAMEWORK and add SIMPLE_JWT settings as shown.

4

Protect API views with authentication

In books/views.py, create a viewset BookViewSet that uses ModelViewSet for the Book model. Add permission_classes with IsAuthenticated to require authentication. In books/urls.py, register the viewset with a router under the path books/. Include these URLs in the main bookproject/urls.py.

Django

from datetime import timedelta

INSTALLED_APPS = [
    # other apps
    'rest_framework',
    'rest_framework.authtoken',
]

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework.authentication.TokenAuthentication',
        'rest_framework_simplejwt.authentication.JWTAuthentication',
    ],
}

SIMPLE_JWT = {
    'ACCESS_TOKEN_LIFETIME': timedelta(minutes=5),
    'REFRESH_TOKEN_LIFETIME': timedelta(days=1),
}

from django.db import models

class Book(models.Model):
    title = models.CharField(max_length=100)
    author = models.CharField(max_length=100)

# In books/views.py, create BookViewSet with IsAuthenticated permission
# In books/urls.py, register BookViewSet with router at 'books/'
# Include books.urls in bookproject/urls.py
# Your code here

Need a hint?

Use ModelViewSet and IsAuthenticated permission to protect the API. Register the viewset with a router and include the URLs in the main project.