dj-rest-auth VS djoser

I am using dj-rest-auth for authentication. I am using JWT token authentication. All advice on JWT tokens is to not store them in local storage. Instead, using this package I store them in HttpOnly cookie. Now, I am apparently vulnerable to CSRF attack. So I enable JWT_AUTH_COOKIE_USE_CSRF. This checks the CSRF token on authenticated requests. However, there is still the potential vulnerability known as "login CSRF" as detailed by this issue on Github. In order to account for this, there is another setting called JWT_AUTH_COOKIE_ENFORCE_CSRF_ON_UNAUTHENTICATED. This enforces CSRF on unauthenticated views (such as login).

Try to use https://github.com/iMerica/dj-rest-auth

I was using djoser in the past. Now Im using very similar dj-rest-auth https://github.com/iMerica/dj-rest-auth

you can use this.

I found the dj-rest-auth as a method of making a rest auth api, unfortunately when using the documentation I have this error coming up.

I've followed the documentation: https://dj-rest-auth.readthedocs.io/en/latest/index.html

Right now, I'm using dj-rest-auth for Token based authentication. I store token in the localStorage. Earlier I was using djoser for adding auth in the project (I wrote article about my approach with djoser).

Please use https://github.com/iMerica/dj-rest-auth as this project is no longer maintained. Thanks!

That's what I'd usually say too, but this issue does give some "neglected project" vibes - the version on pypi is still quite a bit older than what's in the repo.

e.g.: https://github.com/sunscrapers/djoser/blob/master/djoser/constants.py

Right now, I'm using dj-rest-auth for Token based authentication. I store token in the localStorage. Earlier I was using djoser for adding auth in the project (I wrote article about my approach with djoser).

View on GitHub

Djoser is an open-source authentication library for Django. It is a simple library for providing basic authentication in a Django app, and it is used alongside the Django REST Framework. In this article, we will be looking at how to customize URLs in Djoser.

For Djoser this looks to be fine, there is an issue mentioning Django 4.0 but it looks like that just requires a work around for a dependency.

djoser if you are using DRF

Customizing Serializers

A reusable library implementing auth logic in DRF: https://github.com/sunscrapers/djoser

I'm using Djoser on the backend and I want to save tokens in Redis when they are created. I want this because I want to single user from one account can use my app, so I'm about to store all created tokens and then invalidate them if a user with this `id` login's from another device/browser. So my question is, am I need to redefine this method? Please push me in the right direction, I'm kinda lost. Maybe there is a better solution.