Django-Rest-Framework system to check custom HTTP header (application - token) - django

Question

I use Django and Django- rest-framework.
I have to check a custom http header for a lot of my views.
For each view I need to:
Check if the http custom header is there (X-APP-TOKEN);
Check if this token is correct;
Serve the request or return an HTTP error (for example 403);
Is there some approach that I can follow?
For example something like permissions_class for rest-framework view.
I tried to implement a custom permission like this:
class IsAuthorizedApplication(BasePermission):
def has_permission(self, request, view):
app_id = request.META.get(app_settings.APPS_HEADER_AUTHORIZATION_APP_ID)
secret_token = request.META.get(app_settings.APPS_HEADER_AUTHORIZATION_APP_TOKEN)
if app_id and secret_token:
try:
selected_app = Application.objects.get(app_uuid=app_id, status=ApplicationStatusType.ACTIVE)
// Check secret token
return True
except Application.DoesNotExist:
return False
return False
But I think that this approach is based to the authentication system of djnago-rest-framework. Infact in case of 'false return' I receive:
401 - {"detail":"Authentication credentials were not provided."}
Is there some different approach to check custom http headers like the permission-class or have I to write a base View to check the application-token before to serve the request?

Answer 1

you can use this
https://pypi.org/project/djangorestframework-api-key/
Install the latest version with pip:
pip install djangorestframework-api-key
# settings.py
INSTALLED_APPS = [
# ...
"rest_framework",
"rest_framework_api_key",
]
be sure that "rest_framework_api_key", cames after "rest_framework",
Run the included migrations:
python manage.py migrate
then from admin create new key
now
HasAPIKey permission class protects a view behind API key authorization.
You can set the permission globally:
# settings.py
REST_FRAMEWORK = {
"DEFAULT_PERMISSION_CLASSES": [
"rest_framework_api_key.permissions.HasAPIKey",
]
}
or on a per-view basis:
# views.py
from rest_framework.views import APIView
from rest_framework_api_key.permissions import HasAPIKey
class UserListView(APIView):
permission_classes = [HasAPIKey]
# ...
Authorization header
By default, clients must pass their API key via the Authorization header. It must be formatted as follows:
Authorization: Api-Key ********
where ******** refers to the generated API key.
or you can do this
For example, if you set:
# settings.py
API_KEY_CUSTOM_HEADER = "X-APP-TOKEN"
then clients must make authorized requests using:
X-APP-TOKEN: ********

Answer 2

it seems like this response is return by the django auth brcause you have pass auth token in header, for the permission above code looks fine. It should return the 403.
please check the the default setting of the djnago restframework
REST_FRAMEWORK = {
'DEFAULT_PERMISSION_CLASSES': [
'rest_framework.permissions.IsAuthenticated',
]
}
If not specified, this setting defaults to allowing unrestricted access:
'DEFAULT_PERMISSION_CLASSES': [
'rest_framework.permissions.AllowAny',
]

Answer 3

in order to implement custom authentication you need to inherit from "BaseAuthentication" and override the authenticate method it must return None for non-authenticated users or (user, auth) for authenticated users refer to docs for more info
https://www.django-rest-framework.org/api-guide/authentication/#custom-authentication