Web APIs for Django. 🎸
Go to file
Georg Lukas cfd9a7e90a Add machine-readable status to Authentication classes
BasicAuthentication and TokenAuthentication have two failure cases when
they are passed technically valid credentials by an API client:

 - the passed credentials are not correct
 - the credentials are correct but the user is inactive

In both cases, only a human-readable 'detail' is returned in the 401
body, which is translated according to the site settings:

```json
HTTP/1.1 401 Unauthorized
<headers snipped>

{
    "detail": "Ungültiges Token"
}
```

The free-form text and its translation make it impossible for an API
consumer to determine the actual reason (inactive user, out of luck; or
wrong credentials, try again).

This PR adds a machine-readable 'status' field to the response, which
can take one of two values:

1. `invalid-credentials` - returned when the passed username, password
   or token were incorrect.

2. `inactive-user` - returned when the credentials were valid but the
   user account is disabled.

Example:

```json
HTTP/1.1 401 Unauthorized
<headers snipped>

{
    "detail": "Ungültiges Token",
    "status": "invalid-token"
}
```

As this only adds a machine-readable field for the already exposed
human-readable 'detail' field, there are no new security implications.
2022-05-02 14:37:11 +02:00
.github Add StaleBot (#8423) 2022-03-24 09:23:16 +00:00
.tx restore the transifex configuration 2020-10-13 21:30:05 +02:00
docs docs: Add a note on concurrency and races (#6950) 2022-04-24 23:16:18 +01:00
docs_theme Update references to Travis CI after moving to Github Actions (#7909) 2021-04-12 13:14:26 +01:00
licenses Prefer https protocol for links in docs when available 2018-01-15 15:15:21 +01:00
requirements Stop ignoring test outcome for Django 3.2 (#7927) 2021-06-21 11:33:43 +01:00
rest_framework Add machine-readable status to Authentication classes 2022-05-02 14:37:11 +02:00
tests Added test client support for HTTP 307 and 308 redirects (#8419) 2022-03-24 09:57:42 +00:00
.gitignore Update references to Travis CI after moving to Github Actions (#7909) 2021-04-12 13:14:26 +01:00
.pre-commit-config.yaml Update pre-commit for flake8 move (#7907) 2021-04-06 17:49:17 +01:00
codecov.yml Update codecov.yml 2018-10-02 16:57:49 +01:00
CONTRIBUTING.md Update contribution guidelines (#8422) 2022-03-23 11:52:45 +00:00
LICENSE.md Prefer https:// for URLs when available throughout project (#6208) 2018-10-02 08:28:58 +02:00
MANIFEST.in Update MANIFEST.in (#7893) 2021-04-01 14:15:53 +01:00
mkdocs.yml Version 3.13 (#8285) 2021-12-13 13:10:17 +00:00
PULL_REQUEST_TEMPLATE.md De-duplicate contributing guide (#7901) 2021-04-05 11:12:28 +01:00
README.md Fix code block in README.md (#8408) 2022-03-16 11:35:24 +00:00
requirements.txt Lint with pre-commit (#7900) 2021-04-05 12:08:52 +01:00
runtests.py Fix running runtests.py without arguments. (#7954) 2021-05-24 09:47:44 +02:00
SECURITY.md Update SECURITY.md (#8412) 2022-03-16 12:12:25 +00:00
setup.cfg Fix pytest warnings (#7928) 2021-04-16 17:47:21 +01:00
setup.py Fix REQUIRED_PYTHON in setup.py (#8292) 2021-12-13 08:57:55 +00:00
tox.ini Python/Django compatibility updates (#8288) 2021-12-10 15:31:01 +00:00

Django REST framework

build-status-image coverage-status-image pypi-version

Awesome web-browsable Web APIs.

Full documentation for the project is available at https://www.django-rest-framework.org/.


Funding

REST framework is a collaboratively funded project. If you use REST framework commercially we strongly encourage you to invest in its continued development by signing up for a paid plan.

The initial aim is to provide a single full-time position on REST framework. Every single sign-up makes a significant impact towards making that possible.

Many thanks to all our wonderful sponsors, and in particular to our premium backers, Sentry, Stream, Rollbar, ESG, Retool, bit.io, PostHog, and CryptAPI.


Overview

Django REST framework is a powerful and flexible toolkit for building Web APIs.

Some reasons you might want to use REST framework:

There is a live example API for testing purposes, available here.

Below: Screenshot from the browsable API

Screenshot


Requirements

  • Python (3.6, 3.7, 3.8, 3.9, 3.10)
  • Django (2.2, 3.0, 3.1, 3.2, 4.0)

We highly recommend and only officially support the latest patch release of each Python and Django series.

Installation

Install using pip...

pip install djangorestframework

Add 'rest_framework' to your INSTALLED_APPS setting.

INSTALLED_APPS = [
    ...
    'rest_framework',
]

Example

Let's take a look at a quick example of using REST framework to build a simple model-backed API for accessing users and groups.

Startup up a new project like so...

pip install django
pip install djangorestframework
django-admin startproject example .
./manage.py migrate
./manage.py createsuperuser

Now edit the example/urls.py module in your project:

from django.urls import path, include
from django.contrib.auth.models import User
from rest_framework import serializers, viewsets, routers

# Serializers define the API representation.
class UserSerializer(serializers.HyperlinkedModelSerializer):
    class Meta:
        model = User
        fields = ['url', 'username', 'email', 'is_staff']


# ViewSets define the view behavior.
class UserViewSet(viewsets.ModelViewSet):
    queryset = User.objects.all()
    serializer_class = UserSerializer


# Routers provide a way of automatically determining the URL conf.
router = routers.DefaultRouter()
router.register(r'users', UserViewSet)


# Wire up our API using automatic URL routing.
# Additionally, we include login URLs for the browsable API.
urlpatterns = [
    path('', include(router.urls)),
    path('api-auth/', include('rest_framework.urls', namespace='rest_framework')),
]

We'd also like to configure a couple of settings for our API.

Add the following to your settings.py module:

INSTALLED_APPS = [
    ...  # Make sure to include the default installed apps here.
    'rest_framework',
]

REST_FRAMEWORK = {
    # Use Django's standard `django.contrib.auth` permissions,
    # or allow read-only access for unauthenticated users.
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly',
    ]
}

That's it, we're done!

./manage.py runserver

You can now open the API in your browser at http://127.0.0.1:8000/, and view your new 'users' API. If you use the Login control in the top right corner you'll also be able to add, create and delete users from the system.

You can also interact with the API using command line tools such as curl. For example, to list the users endpoint:

$ curl -H 'Accept: application/json; indent=4' -u admin:password http://127.0.0.1:8000/users/
[
    {
        "url": "http://127.0.0.1:8000/users/1/",
        "username": "admin",
        "email": "admin@example.com",
        "is_staff": true,
    }
]

Or to create a new user:

$ curl -X POST -d username=new -d email=new@example.com -d is_staff=false -H 'Accept: application/json; indent=4' -u admin:password http://127.0.0.1:8000/users/
{
    "url": "http://127.0.0.1:8000/users/2/",
    "username": "new",
    "email": "new@example.com",
    "is_staff": false,
}

Documentation & Support

Full documentation for the project is available at https://www.django-rest-framework.org/.

For questions and support, use the REST framework discussion group, or #restframework on libera.chat IRC.

You may also want to follow the author on Twitter.

Security

Please see the security policy.