DRF authentication (Token, JWT) in Django - Step-by-Step Execution

Concept Flow - DRF authentication (Token, JWT)

Client sends login request

↓

Server verifies credentials

↓

If valid

→Generate Token or JWT

↓

Send JWT to client

↓

Send Token to client

↓

Client stores token/JWT

↓

Client sends requests with token/JWT

↓

Server checks token/JWT validity

↓

If valid

→Allow access

↓

Else deny access

This flow shows how a client logs in, receives a token or JWT, and uses it to access protected resources by sending it with requests.

Execution Sample

Django

from rest_framework.authtoken.models import Token
from rest_framework_simplejwt.tokens import RefreshToken
from django.contrib.auth import authenticate

# Token creation example
user = authenticate(username='user', password='pass')
if user:
    token, created = Token.objects.get_or_create(user=user)
    token_key = token.key

# JWT creation example
refresh = RefreshToken.for_user(user)
access_token = str(refresh.access_token)

This code shows how DRF creates a Token or JWT after user authentication.

Execution Table

Step	Action	Input	Output	Notes
1	Client sends login request	username='user', password='pass'	Request received	Client initiates login
2	Server verifies credentials	username='user', password='pass'	User object if valid	Authentication check
3	Generate Token	User object	Token string	DRF Token created
4	Generate JWT	User object	JWT access and refresh tokens	JWT tokens created
5	Send Token/JWT to client	Token or JWT	Token/JWT sent in response	Client receives tokens
6	Client stores token/JWT	Token/JWT	Stored in client storage	Ready for future requests
7	Client sends request with token/JWT	Token/JWT in header	Request received with token	Authentication header included
8	Server checks token/JWT validity	Token/JWT	Valid or invalid	Token verified
9	If valid, allow access	Valid token	Protected resource data	Access granted
10	If invalid, deny access	Invalid token	401 Unauthorized	Access denied

💡 Execution stops after access is granted or denied based on token validity.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	After Step 7	After Step 8	Final
user	None	User object if valid	User object	User object	User object	User object	User object	User object	User object
token	None	None	Token string	Token string	Token string	Token string	Token string	Token string	Token string
jwt_access	None	None	None	JWT access token	JWT access token	JWT access token	JWT access token	JWT access token	JWT access token
jwt_refresh	None	None	None	JWT refresh token	JWT refresh token	JWT refresh token	JWT refresh token	JWT refresh token	JWT refresh token
request_token	None	None	None	None	None	Token/JWT stored	Token/JWT sent with request	Token/JWT validated	Access granted or denied

Key Moments - 3 Insights

Why do we generate both access and refresh tokens in JWT?

Access tokens are short-lived for security; refresh tokens allow getting new access tokens without logging in again. See execution_table rows 4 and 5.

What happens if the token sent by the client is invalid or expired?

The server denies access and returns 401 Unauthorized, as shown in execution_table row 10.

Is the token created at login or on every request?

Token or JWT is created once at login (rows 3 and 4), then sent with each request (row 7) for validation.

Visual Quiz - 3 Questions

Look at the execution_table, what is the output at Step 3?

A Token string

B JWT access token

C User object

D 401 Unauthorized

💡 Hint

Check the 'Output' column for Step 3 in the execution_table.

At which step does the client send the token or JWT with a request?

A Step 2

B Step 5

C Step 7

D Step 9

💡 Hint

Look for 'Client sends request with token/JWT' in the execution_table.

If the token is invalid, what is the server's response according to the execution_table?

A Protected resource data

B 401 Unauthorized

C Token string

D User object

💡 Hint

Check the 'Output' column for Step 10 in the execution_table.

Concept Snapshot

DRF Authentication with Token and JWT:
- Client logs in sending credentials.
- Server verifies and creates Token or JWT.
- Token/JWT sent back to client.
- Client stores and sends token with requests.
- Server validates token to allow or deny access.
- JWT uses access and refresh tokens for security.

Full Transcript

This visual execution trace shows how Django REST Framework (DRF) handles authentication using Token and JWT methods. First, the client sends a login request with username and password. The server checks these credentials. If valid, the server creates either a Token or JWT (which includes access and refresh tokens). These tokens are sent back to the client, who stores them securely. For future requests, the client includes the token or JWT in the request headers. The server then validates the token. If the token is valid, the server grants access to protected resources. If invalid or expired, the server denies access with a 401 Unauthorized response. This process ensures secure, stateless authentication for API access.

Practice

1. What is the main difference between TokenAuthentication and JWTAuthentication in Django REST Framework?

easy

A. TokenAuthentication uses simple tokens stored on the server; JWTAuthentication uses encoded tokens with expiry.

B. TokenAuthentication requires username and password every request; JWTAuthentication does not.

C. TokenAuthentication encrypts tokens; JWTAuthentication sends tokens as plain text.

D. TokenAuthentication is only for web apps; JWTAuthentication is only for mobile apps.

Solution

1. Step 1: Understand TokenAuthentication

   TokenAuthentication uses a simple token string stored on the server and sent by the client to identify the user.

2. Step 2: Understand JWTAuthentication

   JWTAuthentication uses JSON Web Tokens that are encoded, include expiry info, and do not require server storage.

3. Final Answer:

   TokenAuthentication uses simple tokens stored on the server; JWTAuthentication uses encoded tokens with expiry. -> Option A

4. Quick Check:

   Token vs JWT difference = D [OK]

Hint: Token is simple stored string; JWT is encoded with expiry [OK]

Common Mistakes:

• Thinking JWT tokens are stored on the server
• Confusing token encryption with encoding
• Assuming TokenAuthentication requires password every request

2. Which of the following is the correct way to add TokenAuthentication to a Django REST Framework view?

easy

A. authentication_classes = ["rest_framework.authentication.TokenAuthentication"]

B. authentication_classes = [TokenAuthentication]

C. authentication_classes = [rest_framework.authentication.TokenAuthentication]

D. authentication_classes = [TokenAuthentication()]

Solution

1. Step 1: Recall how to import and use authentication classes

   Authentication classes must be imported and instantiated, so use TokenAuthentication() not just the class name or string.

2. Step 2: Check syntax for authentication_classes

   It expects a list of authentication class instances, so the correct syntax is [TokenAuthentication()] with parentheses.

3. Final Answer:

   authentication_classes = [TokenAuthentication()] -> Option D

4. Quick Check:

   Use class instances in list = A [OK]

Hint: Use class instances with parentheses in authentication_classes list [OK]

Common Mistakes:

• Using strings instead of class instances
• Forgetting parentheses after class name
• Not importing TokenAuthentication before use

3. Given this Django REST Framework view snippet using JWTAuthentication, what will happen if the token is expired?

from rest_framework_simplejwt.authentication import JWTAuthentication
from rest_framework.views import APIView
from rest_framework.response import Response

class MyView(APIView):
    authentication_classes = [JWTAuthentication()]

    def get(self, request):
        return Response({"user": str(request.user)})

medium

A. The request will succeed but request.user will be None.

B. The request will succeed and return the user even if token expired.

C. The request will be denied with a 401 Unauthorized error.

D. The server will crash with an exception.

Solution

1. Step 1: Understand JWTAuthentication behavior on expired tokens

   JWTAuthentication checks token expiry and rejects requests with expired tokens by raising an authentication error.

2. Step 2: Effect on the APIView request

   When token is expired, the request is denied with a 401 Unauthorized response automatically by DRF.

3. Final Answer:

   The request will be denied with a 401 Unauthorized error. -> Option C

4. Quick Check:

   Expired JWT causes 401 error = B [OK]

Hint: Expired JWT tokens cause 401 Unauthorized error [OK]

Common Mistakes:

• Assuming expired token returns user as None
• Thinking expired token lets request pass
• Expecting server crash on expired token

4. You wrote this code to enable TokenAuthentication but your API always returns 403 Forbidden. What is the likely mistake?

from rest_framework.authentication import TokenAuthentication

class MyView(APIView):
    authentication_classes = [TokenAuthentication]

    def get(self, request):
        return Response({"message": "Hello"})

medium

A. Forgot to add parentheses after TokenAuthentication in authentication_classes.

B. TokenAuthentication is not imported correctly.

C. The get method should be named post.

D. authentication_classes should be a tuple, not a list.

Solution

1. Step 1: Check authentication_classes syntax

   authentication_classes must contain instances, so TokenAuthentication() with parentheses, not the class itself.

2. Step 2: Effect of missing parentheses

   Without parentheses, DRF does not recognize the authentication class properly, causing 403 Forbidden errors.

3. Final Answer:

   Forgot to add parentheses after TokenAuthentication in authentication_classes. -> Option A

4. Quick Check:

   Use TokenAuthentication() not TokenAuthentication = C [OK]

Hint: Always instantiate authentication classes with () [OK]

Common Mistakes:

• Using class name without parentheses
• Confusing 403 with 401 errors
• Changing method name unnecessarily

5. You want to protect an API endpoint so only users with a valid JWT token can access it, and you want tokens to expire after 5 minutes. Which settings and code changes should you apply?

hard

A. Set TOKEN_EXPIRE_TIME = 300 in settings and use TokenAuthentication() in authentication_classes.

B. Set SIMPLE_JWT['ACCESS_TOKEN_LIFETIME'] = timedelta(minutes=5) in settings and use JWTAuthentication() in authentication_classes.

C. Use JWTAuthentication() in authentication_classes and set JWT_EXPIRATION_DELTA = 5 in settings.

D. Use TokenAuthentication() and manually check token age in the view.

Solution

1. Step 1: Configure JWT token expiry

   In Django REST Framework Simple JWT, set ACCESS_TOKEN_LIFETIME to 5 minutes using timedelta in settings.

2. Step 2: Use JWTAuthentication in the view

   Set authentication_classes = [JWTAuthentication()] to enforce JWT token authentication on the endpoint.

3. Final Answer:

   Set SIMPLE_JWT['ACCESS_TOKEN_LIFETIME'] = timedelta(minutes=5) in settings and use JWTAuthentication() in authentication_classes. -> Option B

4. Quick Check:

   JWT expiry + JWTAuthentication = A [OK]

Hint: Set ACCESS_TOKEN_LIFETIME and use JWTAuthentication() [OK]

Common Mistakes:

• Using TokenAuthentication instead of JWTAuthentication
• Setting wrong expiry setting names
• Trying to manually check token expiry in views