Generate a JWT token in django for authentication between different service - django

Question

My use case is to create a JTW token ( probability from Django Admin ) and use that token from other services ( clients, postman, microservice, etc ). That token should not expire because if it expires than I have to create a new Token and configure all the services again with the new Token. I am aware that 'rest_framework.authtoken' exists but it has some drawbacks -
It doesn't create JWT token
I Can see it in Django Admin after creation, ( I want to surface token only at the time of creation )
I want to have a service similar to most of the sms/email providers have. They provide us an API key and we can use that for future API calls. Looking forward to a solution. Thanks.

Answer 1

DRF has an inbuilt package for JWT authentication all you need is to use that with modulations into JWT KEYS in your settings.py and add jwt authentication to your default authentication classes: (I ADDED A CUSTOM PAYLOAD BUT U CAN ADD THE DEFAULT ONE TOO)
SETTINGS.PY:
INSTALLED_APPS = [
'django.contrib.admin',
'django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.messages',
'django.contrib.staticfiles',
'corsheaders',
'rest_framework',
'rest_framework.authtoken'
]
REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
'rest_framework.authentication.TokenAuthentication',
'rest_framework_jwt.authentication.JSONWebTokenAuthentication',
),
}
JWT_AUTH = {
'JWT_ENCODE_HANDLER':
'rest_framework_jwt.utils.jwt_encode_handler',
'JWT_DECODE_HANDLER':
'rest_framework_jwt.utils.jwt_decode_handler',
'JWT_PAYLOAD_HANDLER':
'rest_framework_jwt.utils.jwt_payload_handler',
'JWT_PAYLOAD_GET_USER_ID_HANDLER':
'rest_framework_jwt.utils.jwt_get_user_id_from_payload_handler',
'JWT_RESPONSE_PAYLOAD_HANDLER':
'rest_framework_jwt.utils.jwt_response_payload_handler',
'JWT_ALLOW_REFRESH': False,
'JWT_REFRESH_EXPIRATION_DELTA': datetime.timedelta(days=365),
'JWT_SECRET_KEY': SECRET_KEY,
# settings for the start of the autorization header
'JWT_AUTH_HEADER_PREFIX': 'JWT',
# Authorization : JWT <token>
'JWT_AUTH_COOKIE': "JwtToken",
}
URLS.PY :(ADD THE FOLLOWING)
from rest_framework_jwt.views import verify_jwt_token
urlpatterns = [
....
path('api/jwt-verify/', verify_jwt_token),
....
]
VIEWS.PY (CREATE THE TOKEN and verify):
##import the below two##
from rest_framework_jwt.utils import jwt_payload_handler
from rest_framework_jwt.utils import jwt_encode_handler
from rest_framework_jwt.utils import jwt_response_payload_handler
##if the requested user is active and authenticated
####user = authenticate(username=username, password=password) is NOT None
if user.is_active:
user_obj = User.objects.get(
username__iexact=username)
payload = jwt_payload_handler(user_obj)
token = jwt_encode_handler(payload)
response_payload = jwt_response_payload_handler(
token, user_obj, request=request)
response = requests.post("http://127.0.0.1:8080/api/jwt-verify/",
{"token": token})
return JsonResponse({'msg': "token is verified", 'token': response_payload['token']}, safe=False, status=response.status_code)

Answer 2

I found https://florimondmanca.github.io/djangorestframework-api-key/ and it fulfills all my requirements. From docs
Django REST Framework API Key is a powerful library for allowing server-side clients to safely use your API. These clients are typically third-party backends and services (i.e. machines) which do not have a user account but still need to interact with your API in a secure way.
✌️ Simple to use: create, view and revoke API keys via the admin site, or use built-in helpers to create API keys programmatically.
🔒 As secure as possible: API keys are treated with the same level of care than user passwords. They are hashed using the default password hasher before being stored in the database, and only visible at creation.
🎨 Customizable: satisfy specific business requirements by building your own customized API key models, permission classes and admin panels
I am using this package now in my project.