Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Drop-in API endpoints for handling authentication securely in Django Rest Framework. Works especially well with SPAs (e.g., React, Vue, Angular), and Mobile applications.
Install package
pip install dj-rest-auth
Add dj_rest_auth
app to INSTALLED_APPS in your django settings.py:
INSTALLED_APPS = (
...,
'rest_framework',
'rest_framework.authtoken',
...,
'dj_rest_auth'
)
Add URL patterns
urlpatterns = [
path('dj-rest-auth/', include('dj_rest_auth.urls')),
]
(Optional) Use Http-Only cookies
REST_AUTH = {
'USE_JWT': True,
'JWT_AUTH_COOKIE': 'jwt-auth',
}
Install required modules with pip install -r dj_rest_auth/tests/requirements.pip
To run the tests within a virtualenv, run python runtests.py
from the repository directory.
The easiest way to run test coverage is with coverage
,
which runs the tests against all supported Django installs. To run the test coverage
within a virtualenv, run coverage run ./runtests.py
from the repository directory then run coverage report
.
Testing may also be done using tox
, which
will run the tests against all supported combinations of Python and Django.
Install tox, either globally or within a virtualenv, and then simply run tox
from the repository directory. As there are many combinations, you may run them
in parallel
using tox --parallel
.
The tox.ini
includes an environment for testing code coverage
and you can run it and view this report with tox -e coverage
.
Linting may also be performed via flake8
by running tox -e flake8
.
View the full documentation here: https://dj-rest-auth.readthedocs.io/en/latest/index.html
This project began as a fork of django-rest-auth
. Big thanks to everyone who contributed to that repo!
This project has optional and very narrow support for Django-AllAuth. As the maintainer, I have no interest in making this package support all use cases in Django-AllAuth. I would rather focus on improving the quality of the base functionality or focus on OIDC support instead. Pull requests that extend or add more support for Django-AllAuth will most likely be declined. Do you disagree? Feel free to fork this repo!
FAQs
Authentication and Registration in Django Rest Framework
We found that dj-rest-auth demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.