django-rest-framework-simplejwt VS frank_jwt

Now, I'm converting this app into a Vue-based SPA (still powered by Django). I'm using the Django REST Framework to build the API that the SPA will interact with. (I'll be using token-based auth, via django-rest-knox. ETA: I'll actually be using djangorestframework-simplejwt.)

Django REST Framework SimpleJWT Django REST Framework SimpleJWT provides JSON Web Token (JWT) authentication for Django REST Framework APIs. It enables secure and stateless token-based authentication, allowing clients to authenticate and access protected endpoints.

I'm using simple JWT with DRF.

So , i was using djangorestframework-simplejwt for token bases authentication with drf.

I used JWT authentication instead. https://github.com/jazzband/djangorestframework-simplejwt

First: the drf token is not a jwt. If you want to use jwt, I recommend the drf simple jwt plugin: https://github.com/jazzband/djangorestframework-simplejwt

There is an issue in the drf-simplejwt repo that I borrowed some code from: https://github.com/jazzband/djangorestframework-simplejwt/issues/71.Is anyone doing authentication with JWT / HttpOnly cookies in a similar way? Thanks for anyone that can take a look or offer some feedback!

I'm not going to go in-depth with it, but I've seen a different technique used to achieve the same result in the SimpleJWT project that can be found in this file in the source code. Basically the technique relies on the settings_changed signal to establish default values for settings and update those settings in the context of the package. I'm not sure if there is a massive improvement on this approach over the previous one (maybe caching?), but if there is, feel free to comment.

I work in FOSS and have a project I can share with that stack. The back-end is here. Change the branch to develop and look in accounts. Its not a perfect example of what you want since we extend the TokenView with VogonTokenVerifyView. Basically you create a login form on your front-end and then make a request to TokenObtainPairView with the login info and it will return tokens if everything went to plan. The vue project can be found here. There is really nothing fancy happening in the frontend, create a form and send the information. I would not save the tokens in localStorage like we are doing. This is a very debated topic but I have come to the conclusion after tons reading on the subject that cookies are a better route. There is an interesting thread on the subject in a pull request in the simplejwt-repo. Once that pull request is merged, we will switch to cookies.

NOTE: Never store sensitive information about a client in the payload as the JWT is just encoded and not encrypted. You can paste the JWT I gave as an example above in this cool site which basically allows you to see in decoded. JSON Web Tokens - jwt.io

Although they did not make it into production, I experimented with the RabbitMQ message broker, Python (Django, Flask), Kubernetes + minikube, JWT, and NGINX. This was a hobby project, but I intended to learn about microservices along the way.

JSON Web Token (JWT) creation to extend user authentication to server-side functions

The (probably) most famous web resource about JWT - https://jwt.io - provides such a definition of JSON Web Tokens:

If you want to play with JWT and put these concepts into practice, you can use jwt.ioDebugger to decode, verify, and generate JWTs.

In this context, JSON Web Tokens (JWTs) play a crucial role.

Json Web Token (JWT): Even though it is more like an industry standard, we will use JWTs for stateless authentication in this article. If you want to learn more, you can refer to the official documentation.

Se pegar o token jwt podemos ver o que tem dentro, usando o site jwt.io.