django-oauth-toolkit VS dj-rest-auth

View on GitHub

Just to be clear: I'm asking for LDAP to be one possible choice. If an installation wants to use LDAP BIND they can use that, or if the want to use SAML they could use that, or OATH. But not at the same time: you get to choose one.

Django Authentication system for example has a User object that allows different backends to feed into it:

* https://django-auth-ldap.readthedocs.io/

* https://django-oauth-toolkit.readthedocs.io/

* https://stackoverflow.com/questions/22668434/saml-with-djang...

You would need to store whatever identifier the oauth provider gives you along with access and refresh tokens. That said, I wouldn't try to implement this from scratch, since it is not trivial. Try django-oauth-toolkit

Thankfully you don't need to implement this giant standard yourself. You can use the excellent Django OAuth Toolkit package. They also have a specific section in their documentation for using it with DRF.

I would suggest token auth as it is stateless, secure and can be used on multiple devices. OAuth/OAuth2 is the industry standard at the moment but you can also use a simple JWT token signature. On top of this, Django REST framework offers a lot of libraries for this purpose e.g. django-rest-framework-simplejwt, django-rest-framework-social-oauth2, django-oauth-toolkit, and more.

I am using dj-rest-auth for authentication. I am using JWT token authentication. All advice on JWT tokens is to not store them in local storage. Instead, using this package I store them in HttpOnly cookie. Now, I am apparently vulnerable to CSRF attack. So I enable JWT_AUTH_COOKIE_USE_CSRF. This checks the CSRF token on authenticated requests. However, there is still the potential vulnerability known as "login CSRF" as detailed by this issue on Github. In order to account for this, there is another setting called JWT_AUTH_COOKIE_ENFORCE_CSRF_ON_UNAUTHENTICATED. This enforces CSRF on unauthenticated views (such as login).

Try to use https://github.com/iMerica/dj-rest-auth

I was using djoser in the past. Now Im using very similar dj-rest-auth https://github.com/iMerica/dj-rest-auth

you can use this.

I found the dj-rest-auth as a method of making a rest auth api, unfortunately when using the documentation I have this error coming up.

I've followed the documentation: https://dj-rest-auth.readthedocs.io/en/latest/index.html

Right now, I'm using dj-rest-auth for Token based authentication. I store token in the localStorage. Earlier I was using djoser for adding auth in the project (I wrote article about my approach with djoser).

Please use https://github.com/iMerica/dj-rest-auth as this project is no longer maintained. Thanks!