ssaavedra / drf-jwt-knox

Django REST Framework JWT-based Authentication with Server-Side Tokens.

DRF JWT + Knox

This package provides an authentication mechanism for Django REST Framework based on JSON Web Tokens in the browser backed up by Knox-powered tokens in the database.

This package aims to take the better parts of both worlds, including:

• Expirable tokens: The tokens may be manually expired in the database, so a user can log out of all other logged-in places, or everywhere.
• Different tokens per login attempt (per user-agent), meaning that a user's session is tied to the specific machine and logging can be segregated per usage.
• JWT-based tokens, so the token can have an embedded expiration time, and further metadata for other applications.
• Tokens are generated via OpenSSL so that they are cryptographically more secure.
• Only the tokens' hashes are stored in the database, so that even if the database gets dumped, an attacker cannot impersonate people through existing credentials
• Other applications sharing the JWT private key can also decrypt the JWT

Usage

Add this application and knox to INSTALLED_APPS in your settings.py.

Then, add this app's routes to some of your urlpatterns.

You can use the verify endpoint to verify whether a token is valid or not (which may be useful in a microservice architecture).

Tests

Tests are automated with tox and run on Travis-CI automatically. You can check the status in Travis, or just run tox from the command line.

Contributing

This project uses the GitHub Flow approach for contributing, meaning that we would really appreciate it if you would send patches as Pull Requests in GitHub. If for any reason you prefer to send patches by email, they are also welcome and will end up being integrated here.

License

This code is released under the Apache Software License Version 2.0.

drf-jwt-knox's Issues

Incompatibility with DRF 3.11

[   70s] ___________________ ERROR collecting tests/test_jwt_knox.py ____________________
[   70s] tests/test_jwt_knox.py:11: in <module>
[   70s]     class APIAuthTest(APITestCase):
[   70s] tests/test_jwt_knox.py:20: in APIAuthTest
[   70s]     login_url = reverse('jwt_knox-get-token')
[   70s] /usr/lib/python3.8/site-packages/django/urls/base.py:90: in reverse
[   70s]     return iri_to_uri(resolver._reverse_with_prefix(view, prefix, *args, **kwargs))
[   70s] /usr/lib/python3.8/site-packages/django/urls/resolvers.py:613: in _reverse_with_prefix
[   70s]     self._populate()
[   70s] /usr/lib/python3.8/site-packages/django/urls/resolvers.py:447: in _populate
[   70s]     for url_pattern in reversed(self.url_patterns):
[   70s] /usr/lib/python3.8/site-packages/django/utils/functional.py:80: in __get__
[   70s]     res = instance.__dict__[self.name] = self.func(instance)
[   70s] /usr/lib/python3.8/site-packages/django/urls/resolvers.py:584: in url_patterns
[   70s]     patterns = getattr(self.urlconf_module, "urlpatterns", self.urlconf_module)
[   70s] /usr/lib/python3.8/site-packages/django/utils/functional.py:80: in __get__
[   70s]     res = instance.__dict__[self.name] = self.func(instance)
[   70s] /usr/lib/python3.8/site-packages/django/urls/resolvers.py:577: in urlconf_module
[   70s]     return import_module(self.urlconf_name)
[   70s] /usr/lib/python3.8/importlib/__init__.py:127: in import_module
[   70s]     return _bootstrap._gcd_import(name[level:], package, level)
[   70s] tests/urls.py:1: in <module>
[   70s]     from jwt_knox.urls import urlpatterns
[   70s] jwt_knox/urls.py:13: in <module>
[   70s]     router.register(r'', JWTKnoxAPIViewSet, base_name='jwt_knox')
[   70s] E   TypeError: register() got an unexpected keyword argument 'base_name'

Missing README

v0.1.1 not published on PyPi

Thank you for the work on this project!

Latest version on pypi is 0.1.0, would be great if the latest version could be published there as well.

Also if there's anything you can use contributions on let me know, maybe I can help.

Thanks

Switch buildtools to use pbr

Use pbr in order to set up the build process and to extract the version from git tags and publish to PyPI.