In this tutorial we'll learn how to add JWT authentication to an API built with Django REST framework. Basically we'll use the djangorestframework-jwt
package for adding JWT authentication as you would normally do except that we'll change JWT_AUTH
to use Auth0.
This tutorial assumes you already have a development machine with Python 3 and pip installed and will cover the following points:
- We'll see how to create a virtual environment, install Django and the other dependencies (Django REST framework and
djangorestframework-jwt
) - We'll see how to create an Auth0 API
- We'll see how to integrate Auth0 JWT authentication with Django
- We'll briefdly talk about using Auth0 Rules for detecting signup
- We'll see how to add some Django views for testing JWT
- We'll see how to use Postman for testing JWT authentication with Auth0
Creating the Django Project
So head over to your terminal then create a new virtual environment and activate it using the venv
module in your current working directory:
python3 -m venv ./myenv
source myenv/bin/activate
Next install Django using pip
:
pip install django
Now you'll need to create a new Django project using:
django-admin startproject auth0-django-example
Next create a new application in your project
cd auth0-django-example
python manage.py startapp customers
Add customers
to the installed apps in your project' settings.py
file:
INSTALLED_APPS = [
'django.contrib.admin',
'django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.messages',
'django.contrib.staticfiles',
'customers'
]
Next migrate your database then start the development server
python manage.py migrate
python manage.py runserver
You can visit your app at http://localhost:8000
Create an Auth0 API
Head over to your Auth0 dashboard then create an API
Go to the API section then click on the CREATE API button which will show a form where you need to enter your API details
Integrating Auth0 with Django
Now head back to your terminal then install Django REST framework and djangorestframework-jwt
package for handling JWT authentication using pip
pip install djangorestframework
pip install djangorestframework-jwt
pip install cryptography
pip install python-jose
Add rest_framework
and rest_framework_jwt
to the installed apps in settings.py
:
INSTALLED_APPS = [
'rest_framework',
'rest_framework_jwt'
]
Next you'll need to setup djangorestframework-jwt
to use Auth0 central server for JWT authentication by follwing a few steps.
First add JSONWebTokenAuthentication
to DEFAULT_AUTHENTICATION_CLASSES
:
REST_FRAMEWORK = {
'DEFAULT_PERMISSION_CLASSES': (
'rest_framework.permissions.IsAuthenticated',
),
'DEFAULT_AUTHENTICATION_CLASSES': (
'rest_framework_jwt.authentication.JSONWebTokenAuthentication',
),
}
Secondly import the follwing libs in your settings.py
file:
import json
from six.moves.urllib import request
from cryptography.x509 import load_pem_x509_certificate
from cryptography.hazmat.backends import default_backend
Finally add this code to settings.py
:
AUTH0_DOMAIN = '<YOUR_AUTH0_DOMAIN>'
API_IDENTIFIER = '<YOUR_API_IDENTIFIER>'
PUBLIC_KEY = None
JWT_ISSUER = None
if AUTH0_DOMAIN:
jsonurl = request.urlopen('https://' + AUTH0_DOMAIN + '/.well-known/jwks.json')
jwks = json.loads(jsonurl.read().decode('utf-8'))
cert = '-----BEGIN CERTIFICATE-----\n' + jwks['keys'][0]['x5c'][0] + '\n-----END CERTIFICATE-----'
certificate = load_pem_x509_certificate(cert.encode('utf-8'), default_backend())
PUBLIC_KEY = certificate.public_key()
JWT_ISSUER = 'https://' + AUTH0_DOMAIN + '/'
def jwt_get_username_from_payload_handler(payload):
return 'someusername'
JWT_AUTH = {
'JWT_PAYLOAD_GET_USERNAME_HANDLER': jwt_get_username_from_payload_handler,
'JWT_PUBLIC_KEY': PUBLIC_KEY,
'JWT_ALGORITHM': 'RS256',
'JWT_AUDIENCE': API_IDENTIFIER,
'JWT_ISSUER': JWT_ISSUER,
'JWT_AUTH_HEADER_PREFIX': 'Bearer',
}
But of course you need to replace AUTH0_DOMAIN
with your own Auth0 domain and API_IDENTIFIER
with your own API identifier.
Please note that you need to create a user in your Django database with a someusername
username for the JWT authentication to work.
The custom jwt_get_username_from_payload_handler
that we are using is very simple, it maps your Auth0 users to one user in your Django database.
Because Auth0 already takes care of managing users and profiles for you so most of the time you don't have to store users locally i.e in your Django database unless you need to have users information in your database for some reason.
In this case you'll need to create a more advanced implementation. You can use this custom method instead:
def jwt_get_username_from_payload_handler(payload):
return payload.get('sub').replace('|', '.')
But that's not the end of story: You need to create a Django user when a user successfully signs up using Auth0.
Using Auth0 Rules for Detecting Signup
For this task you need to use Auth0 Rules
Rules are functions written in JavaScript that are executed in Auth0 as part of the transaction every time a user authenticates to your application. They are executed after the authentication and before the authorization.
Rules allow you to easily customize and extend Auth0's capabilities. They can be chained together for modular coding and can be turned on and off individually. Source
You can also see this example of a signup rule
Adding Django Views
Now let's add the code to test the Auth0 JWT authentication:
In customers/views.py
add two view functions
from rest_framework.decorators import api_view
from django.http import HttpResponse
def public(request):
return HttpResponse("You don't need to be authenticated to see this")
@api_view(['GET'])
def private(request):
return HttpResponse("You should not see this message if not authenticated!");
In urls.py
add:
from django.conf.urls import url
from . import views
urlpatterns = [
url(r'^api/public/', views.public),
url(r'^api/private/', views.private)
]
Testing JWT Authentication with Postman
Go to your API dashboard then to the Test tab then get a token you can use to test authentication
Next navigate with your web browser to http://localhost:8000/api/private/
. You should get Authentication credentials were not provided.
Now let's use Postman for testing our endpoint: Open Postman then enter the URL for the endpoint then select Authorization tab.
For the TYPE select Bearer Token and in the right area enter the access token you get from Auth0 for testing.
Finally press the Send button, you should get: You should not see this message if not authenticated! as in the screenshot
Conclusion
In this tutorial we have created a simple Django application that uses Django REST framework and Auth0 for adding JWT authentication.
Top comments (0)