Middleware handler for Mobile and Browser API calls - django

Question

I want to develop a Django based web service where my web application (Platform:Angular JS) and mobile applications (Platform: iOS,android,Windows Phone) will communicate with it.
My django web service app only for handling API calls. For security reasons I chose Oauth toolkit for mobile application,for web Session Authentication?
Settings.py for Authentication,
'DEFAULT_AUTHENTICATION_CLASSES': (
'rest_framework.authentication.SessionAuthentication',
'oauth2_provider.ext.rest_framework.OAuth2Authentication',
),
My problem:
I want to handle CSRF based authentication if I received a call from browser side.
Call Oauth authentication if I received call from Native Mobile client .
How to diferentiate the two, and how to handle this authentication technique.
Need your help!!

Answer 1

You can use django-mobile library to detect requests from mobile browsers and then call diferent authentication classes.
django-mobile library defines MobileDetectionMiddleware and SetFlavourMiddleware middleware classes in it.
MobileDetectionMiddleware detects if the requests originated from a mobile or a web browser.
SetFlavourMiddleware class sets the flavour attribute in the request. There are 2 possible values for flavour:
'mobile' # Mobile requests
'full' # Web requests
After the correct flavour is somehow chosen by the middlewares, it's assigned to the request.flavour attribute.
Step-1: Configure django-mobile in your application
Follow the steps given in https://github.com/gregmuellegger/django-mobile#installation to install and configure django-mobile in your application.
After it has been configured, you can just use request.flavour to check if request is from a mobile browser or a web browser.
Step-2: Create a custom WebSessionAuthentication class
Since you want to use OAuth's OAuth2Authenticationfor mobile application and DRF's SessionAuthentication for web, we can create a custom WebSessionAuthentication class which will inherit from the DRF's SessionAuthentication.
This WebSessionAuthentication class will perform no authentication for mobile requests. In case of web requests, it will perform proper session authentication with CSRF checks.
from rest_framework.authentication import SessionAuthentication
class WebSessionAuthentication(SessionAuthentication):
"""
Performs session authentication for web requests
"""
def authenticate(self, request):
"""
Returns a `User` if the request session currently has a logged in user
and request is a web request
Otherwise returns `None`.
"""
underlying_request = request._request # get the underlying HttpRequest object
if underlying_request.flavour == 'mobile': # check if mobile request
return None # No authentication performed for mobile requests
# For web requests perform DRF's original session authentication
return super(WebSessionAuthentication, self).authenticate(request)
Step-3: Create a custom MobileOAuth2Authentication class
MobileOAuth2Authentication class performs authentication for only mobile requests i.e. having .flavour as mobile. No authentication is performed for web requests.
from oauth2_provider.ext.rest_framework import OAuth2Authentication
class MobileOAuth2Authentication(OAuth2Authentication):
"""
Performs outh2 authentication for mobile requests
"""
def authenticate(self, request):
"""
Returns two-tuple of (user, token) if mobile authentication succeeds,
or None otherwise.
"""
underlying_request = request._request # get the underlying HttpRequest object
if underlying_request.flavour == 'full': # check if web request
return None # No authentication performed for web requests
# For mobile requests perform OAuth2's original authentication
return super(MobileOAuth2Authentication, self).authenticate(request)
Step-4: Define your authentication classes in settings
After creating custom WebSessionAuthentication and MobileOuth2Authentication authentication classes, define these authentication class in your project settings.
'DEFAULT_AUTHENTICATION_CLASSES': (
'my_app.authentication.WebSessionAuthentication', # custom session authentication class for web requests
'my_app.authentication.MobileOAuth2Authentication', # custom oauth2 authentication class for mobile requests
),