Authentication
Authentication is the mechanism of associating an incoming request with a set of identifying credentials, such as the user the request came from, or the token that it was signed with. The permission and throttling policies can then use those credentials to determine if the request should be permitted.
REST framework provides a number of authentication policies out of the box, and also allows you to implement custom policies.
Authentication will run the first time either the request.user
or request.auth
properties are accessed, and determines how those properties are initialized.
The request.user
property will typically be set to an instance of the contrib.auth
package's User
class.
The request.auth
property is used for any additional authentication information, for example, it may be used to represent an authentication token that the request was signed with.
-
The request.auth
property is used for any additional authentication information, for example, it may be used to represent an authentication token that the request was signed with.
How authentication is determined
Authentication is always set as a list of classes. REST framework will attempt to authenticate with each class in the list, and will set request.user
and request.auth
using the return value of the first class that successfully authenticates.
If no class authenticates, request.user
will be set to an instance of django.contrib.auth.models.AnonymousUser
, and request.auth
will be set to None
.
request.user
will be a django.contrib.auth.models.User
instance.request.auth
will be None
.TokenBasicAuthentication
-This policy uses HTTP Basic Authentication, signed against a token key and secret. Token basic authentication is appropriate for client-server setups, such as native desktop and mobile clients.
-Note: If you run TokenBasicAuthentication
in production your API must be https
only, or it will be completely insecure.
If successfully authenticated, TokenBasicAuthentication
provides the following credentials.
TokenAuthentication
+This policy uses HTTP Authentication with no authentication scheme. Token basic authentication is appropriate for client-server setups, such as native desktop and mobile clients. The token key should be passed in as a string to the "Authorization" HTTP header. For example:
+curl http://my.api.org/ -X POST -H "Authorization: 0123456789abcdef0123456789abcdef"
+
+Note: If you run TokenAuthentication
in production your API must be https
only, or it will be completely insecure.
If successfully authenticated, TokenAuthentication
provides the following credentials.
request.user
will be adjango.contrib.auth.models.User
instance.
-request.auth
will be adjangorestframework.models.BasicToken
instance.
+request.auth
will be adjangorestframework.tokenauth.models.BasicToken
instance.
To use the TokenAuthentication
policy, you must have a token model. Django REST Framework comes with a minimal default token model. To use it, include djangorestframework.tokenauth
in your installed applications and sync your database. To use your own token model, subclass the djangorestframework.tokenauth.TokenAuthentication
class and specify a model
attribute that references your custom token model. The token model must provide user
, key
, and revoked
attributes. Refer to the djangorestframework.tokenauth.models.BasicToken
model as an example.
OAuthAuthentication
This policy uses the OAuth 2.0 protocol to authenticate requests. OAuth is appropriate for server-server setups, such as when you want to allow a third-party service to access your API on a user's behalf.
If successfully authenticated, OAuthAuthentication
provides the following credentials.