JWT Authentication in DRF

1. The Access and Refresh Token Strategy

In a typical JWT implementation, we don't just issue one token. Instead, we issue two: an Access Token and a Refresh Token. This pattern is a security best practice.

• Access Token: This is a short-lived token (e.g., 15 minutes) that is sent with every API request to prove authentication. Because it's short-lived, the risk is minimized if it's ever compromised.
• Refresh Token: This is a long-lived token (e.g., several days) that is stored securely by the client. Its only purpose is to request a new access token when the old one expires. It is never sent to access data endpoints.

This two-token system provides a good balance between security and user experience, as the user doesn't need to log in with their password every 15 minutes.

2. Setting Up djangorestframework-simplejwt

The most popular library for adding JWT support to DRF is djangorestframework-simplejwt. It's powerful, customizable, and handles the complexities of token generation and verification for us.

We'll follow a clear, three-step process: install the library, configure it in settings.py, and set up the necessary URL endpoints.

Let's break down the steps from the video for clarity:

Step 1: Install the Package
In your activated virtual environment, run:

pip install djangorestframework-simplejwt

Step 2: Configure settings.py
You need to tell DRF to use simplejwt as its default authentication method. Modify your REST_FRAMEWORK dictionary:

# in settings.py

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework_simplejwt.authentication.JWTAuthentication',
        # Keep other authentication classes if needed, e.g., for the browsable API
        'rest_framework.authentication.SessionAuthentication', 
    ),
    # ... other settings
}

DRF attempts to authenticate using each class in this list in order. By placing JWTAuthentication first, we make it the primary method for our API.

Step 3: Configure urls.py
The library provides built-in views for obtaining and refreshing tokens. We just need to wire them up in our project's main urls.py.

Your urls.py should include these patterns:

# in your project's urls.py

from django.urls import path, include
from rest_framework_simplejwt.views import (
    TokenObtainPairView,
    TokenRefreshView,
)

urlpatterns = [
    # ... your other urls
    path('api/token/', TokenObtainPairView.as_view(), name='token_obtain_pair'),
    path('api/token/refresh/', TokenRefreshView.as_view(), name='token_refresh'),
]

With these three steps, your backend is now ready to issue and verify JWTs.

3. JWT in Action: The Authentication Flow

Now, let's use the endpoints we just created.

Here is a summary of the flow shown in the video:

1. Obtain Tokens: Send a POST request to your /api/token/ endpoint with the user's credentials in the request body.

   • Request Body: {"username": "your_username", "password": "your_password"}
   • Successful Response: The server will return a JSON object containing access and refresh tokens.

2. Decode the Token (Optional but Recommended): Copy the access token and paste it into the debugger on jwt.io. This is a great way to visually confirm the concepts from our previous lesson. You will see the decoded header and payload, including claims like user_id and the expiration time (exp). This reinforces that the token is self-contained but not encrypted.

3. Access a Protected Endpoint: To access a protected view, include the access token in the Authorization header of your request, prefixed with "Bearer".

   • Header: Authorization: Bearer <your_access_token>
   • If the token is valid, DRF will authenticate the user and grant access. If the token is missing, expired, or tampered with, you will receive a 401 Unauthorized error.

4. Customizing Token Behavior

simplejwt is highly configurable. You can control token lifetimes, signing algorithms, and more through a SIMPLE_JWT dictionary in your settings.py. Your background in building complex systems will make you appreciate this level of control.

A common configuration looks like this:

# in settings.py
from datetime import timedelta

SIMPLE_JWT = {
    "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5),
    "REFRESH_TOKEN_LIFETIME": timedelta(days=1),
    "ROTATE_REFRESH_TOKENS": False,
    "BLACKLIST_AFTER_ROTATION": False,
    "UPDATE_LAST_LOGIN": False,

    "ALGORITHM": "HS256",
    "SIGNING_KEY": SECRET_KEY,

    "AUTH_HEADER_TYPES": ("Bearer",),
}

Here, we've set access tokens to expire in 5 minutes and refresh tokens to expire in 1 day.

5. Advanced Topic: Security with Blacklisting

What happens if a refresh token is stolen? The attacker could use it to generate new access tokens until it expires. To mitigate this, we can implement token blacklisting. When a user logs out, we add their refresh token to a "blacklist" so it can no longer be used.

The process involves three steps:

1. Add to INSTALLED_APPS: Add 'rest_framework_simplejwt.token_blacklist' to your INSTALLED_APPS in settings.py.
2. Migrate: Run python manage.py migrate. This creates the database table to store blacklisted tokens.
3. Create a Logout View: Implement a view that takes a refresh token from the request body and adds it to the blacklist.

Here is an example of a logout view, as shown in the article:

# in your views.py
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import status
from rest_framework.permissions import IsAuthenticated
from rest_framework_simplejwt.tokens import RefreshToken

class LogoutView(APIView):
    permission_classes = (IsAuthenticated,)

    def post(self, request):
        try:
            refresh_token = request.data["refresh"]
            token = RefreshToken(refresh_token)
            token.blacklist()
            return Response(status=status.HTTP_205_RESET_CONTENT)
        except Exception as e:
            return Response(status=status.HTTP_400_BAD_REQUEST)

When a user logs out, the client sends their refresh token to this endpoint, effectively invalidating it for future use.

Conclusion

Congratulations! You've successfully implemented a modern, stateless JWT authentication system in your Django REST Framework API. You've moved beyond the basic built-in tools to a solution that is robust, scalable, and secure.

Key Takeaways:

• Implementation: We use djangorestframework-simplejwt to handle JWTs in DRF. The setup involves installing the package, and configuring settings.py and urls.py.
• Token Flow: Users authenticate with credentials at /api/token/ to get an access and refresh token pair.
• Authorization: The short-lived access token is sent in the Authorization: Bearer <token> header to access protected resources.
• Token Refresh: When the access token expires, the long-lived refresh token is sent to /api/token/refresh/ to get a new access token.
• Security: Token lifetimes can be configured for a balance of security and usability. Blacklisting refresh tokens on logout is a critical step to prevent misuse of stolen tokens.

Preview of the Next Lesson:
So far in this module, we've focused on authentication—the process of verifying who a user is. Now that we have a solid authentication system, the next logical step is authorization: controlling what an authenticated user is allowed to do. In the next module, we will dive into Django's and DRF's permission systems to implement role-based access control and secure our API endpoints even further.