Django-rest-auth : How refresh Token? - django

Question

I'm using Django-rest-auth for authentication (https://django-rest-auth.readthedocs.io).
but when I register a new account, the api sent back to me a Token who never change after.
For more security, how can I do to have a new token every time I login ?

Answer 1

If you are working with an API, please structure your code in such a way.
class LoginAPIView(GenericAPIView):
serializer_class = LoginFormSerializer
#csrf_exempt
def post(self, request):
serializer = LoginFormSerializer(data=request.data)
if not serializer.is_valid():
return error_message(message=MessageKey.ERROR_MISSING_USERNAME_OR_PASSWORD.value)
username = serializer.data['username']
password = serializer.data['password']
try:
user = authenticate(username=username, password=password)
if not user:
return error_message(message=MessageKey.ERROR_INVALID_USERNAME_OR_PASSWORD.value)
if user.record_status == RecordStatus.ACTIVE.name:
# Create a new auth token using your token service
auth_token = create_auth_token(user)
user_serializer = UserSerializer(user)
user_data = user_serializer.data
user_data['auth_token'] = str(auth_token[0])
data = generate_user_account_profile(language, user, user_data)
return success_message(data=data)
else:
return error_message(MessageKey.ERROR_INVALID_USERNAME_OR_PASSWORD.value)
except Exception as ex:
traceback.print_exc()
return error_message(MessageKey.ERROR_DEFAULT_ERROR_MESSAGE.value)
The function create_auth_token(user) can be structured as folloows;
def create_auth_token(user):
"""
This is used to create or update an auth token
:param user:
:return:
"""
try:
token = Token.objects.filter(user=user)
if not token:
token = Token.objects.get_or_create(user=user)
else:
token = Token.objects.filter(user=user)
new_key = token[0].generate_key()
# Encrypt random string using SHA1
sha1_algorithm = hashlib.sha1()
sha1_algorithm.update(new_key.encode('utf-8'))
first_level_value = sha1_algorithm.hexdigest()
# Encrypt random string using MD5
md5_algorithm = hashlib.md5()
md5_algorithm.update(first_level_value.encode('utf-8'))
second_level_value = md5_algorithm.hexdigest()
token.update(key=second_level_value)
return token
except Exception as ex:
logging.error(msg=f'Failed to create auth token {ex}', stacklevel=logging.CRITICAL)
pass
Note: This can be adjusted to fit in any place of your choice i.e you can adjust it to work in your view.py file, services, etc