Token Authentication for RESTful API: should the token be periodically changed?

by

It is good practice to have mobile clients periodically renew their authentication token. This of course is up to the server to enforce.

The default TokenAuthentication class does not support this, however you can extend it to achieve this functionality.

For example: 

from rest_framework.authentication import TokenAuthentication, get_authorization_header
from rest_framework.exceptions import AuthenticationFailed

class ExpiringTokenAuthentication(TokenAuthentication):
    def authenticate_credentials(self, key):
        try:
            token = self.model.objects.get(key=key)
        except self.model.DoesNotExist:
            raise exceptions.AuthenticationFailed('Invalid token')

        if not token.user.is_active:
            raise exceptions.AuthenticationFailed('User inactive or deleted')

        # This is required for the time comparison
        utc_now = datetime.utcnow()
        utc_now = utc_now.replace(tzinfo=pytz.utc)

        if token.created < utc_now - timedelta(hours=24):
            raise exceptions.AuthenticationFailed('Token has expired')

        return token.user, token

It is also required to override the default rest framework login view, so that the token is refreshed whenever a login is done:

class ObtainExpiringAuthToken(ObtainAuthToken):
    def post(self, request):
        serializer = self.serializer_class(data=request.data)
        if serializer.is_valid():
            token, created =  Token.objects.get_or_create(user=serializer.validated_data['user'])

            if not created:
                # update the created time of the token to keep it valid
                token.created = datetime.datetime.utcnow()
                token.save()

            return Response({'token': token.key})
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

obtain_expiring_auth_token = ObtainExpiringAuthToken.as_view()

And don’t forget to modify the urls:

urlpatterns += patterns(
    '',
    url(r'^users/login/?$', '<path_to_file>.obtain_expiring_auth_token'),
)

More Related Contents:

  1. Django REST Framework: adding additional field to ModelSerializer
  2. Django Rest Framework: Disable field update after object is created
  3. Capturing URL parameters in request.GET
  4. Django Rest Framework remove csrf
  5. How do I create multiple model instances with Django Rest Framework?
  6. Django rest framework nested self-referential objects
  7. Custom error messages in Django Rest Framework serializer
  8. How to change field name in Django REST Framework
  9. Django REST Framework POST nested objects
  10. Django Rest Framework: Dynamically return subset of fields
  11. SocketException: OS Error: Connection refused, errno = 111 in flutter using django backend
  12. How to set current user to user field in Django Rest Framework?
  13. 405 POST method not allowed
  14. CSRF Failed: CSRF token missing or incorrect
  15. Django REST Framework serializer field required=false
  16. How to cURL an Authenticated Django App?
  17. How to register users in Django REST framework?
  18. AngularJS + Django Rest Framework + CORS ( CSRF Cookie not showing up in client )
  19. What’s the appropriate HTTP status code to return if a user tries logging in with an incorrect username / password, but correct format?
  20. How to get Request.User in Django-Rest-Framework serializer?
  21. Pass request context to serializer from Viewset in Django Rest Framework
  22. Adding root element to json response (django-rest-framework)
  23. Authorization Credentials Stripped — django, elastic beanstalk, oauth
  24. How to programmatically call a Django Rest Framework view within another view?
  25. Django REST Framework image upload
  26. Django/DRF – 405 Method not allowed on DELETE operation
  27. How to pass extra context to Django Rest Framework serializers
  28. Django Rest framework, how to include ‘__all__’ fields and a related field in ModelSerializer ?
  29. context in nested serializers django rest framework
  30. Multiple lookup_fields for django rest framework

Leave a Comment