OAuth signin with django rest framework.
To have a resource, that will do very simple thing: take the oauth code from social provider (for example facebook) and return the authenticated user. That's it.
I can't find such util for django rest framework. There are packages (for example django-rest-auth), that take access_token, not the code. Also, i've used to work with awesome library python-social-auth, so it will be nice to use it again (now it is split into social-core and social-app-django). In fact, most of the work is done by this package. Current util brings a little help to integrate django-rest-framework and python-social-auth.
Install this package to your python distribution:
pip install rest-social-auth
Do the settings
Install apps
INSTALLED_APPS = (
...
'rest_framework',
'rest_framework.authtoken', # only if you use token authentication
'social_django', # django social auth
'rest_social_auth', # this package
'knox', # Only if you use django-rest-knox
)
social auth settings, look documentation for more details
SOCIAL_AUTH_FACEBOOK_KEY = 'your app client id'
SOCIAL_AUTH_FACEBOOK_SECRET = 'your app client secret'
SOCIAL_AUTH_FACEBOOK_SCOPE = ['email', ] # optional
SOCIAL_AUTH_FACEBOOK_PROFILE_EXTRA_PARAMS = {'locale': 'ru_RU'} # optional
AUTHENTICATION_BACKENDS = (
'social_core.backends.facebook.FacebookOAuth2',
# and maybe some others ...
'django.contrib.auth.backends.ModelBackend',
)
Also look optional settings avaliable.
Make sure everything is up do date
python manage.py migrate
Include rest social urls (choose at least one)
path('api/login/', include('rest_social_auth.urls_session')),
path('api/login/', include('rest_social_auth.urls_token')),
path('api/login/', include('rest_social_auth.urls_jwt_pair')),
or / and
path('api/login/', include('rest_social_auth.urls_jwt_sliding')),
path('api/login/', include('rest_social_auth.urls_knox')),
You are ready to login users
Following examples are for OAuth 2.0.
5.1 session authentication
POST /api/login/social/session/
input:
{
"provider": "facebook",
"code": "AQBPBBTjbdnehj51"
}
output:
{
"username": "Alex",
"email": "user@email.com",
// other user data
}
+ session id in cookies
5.2 token authentication
POST /api/login/social/token/
input:
{
"provider": "facebook",
"code": "AQBPBBTjbdnehj51"
}
output:
{
"token": "68ded41d89f6a28da050f882998b2ea1decebbe0"
}
POST /api/login/social/token_user/
input:
{
"provider": "facebook",
"code": "AQBPBBTjbdnehj51"
}
output:
{
"username": "Alex",
"email": "user@email.com",
// other user data
"token": "68ded41d89f6a28da050f882998b2ea1decebbe0"
}
5.3 jwt authentication (using django-rest-framework-simplejwt)
POST /api/login/social/jwt-pair/
POST /api/login/social/jwt-pair-user/
Similar to token authentication, but token is JSON Web Token.
See JWT.io for details.
To use it, django-rest-framework-simplejwt must be installed.
For jwt-pair, the response will include additional "refresh" token:
{
"token": "...",
"refresh": "..."
}
POST /api/login/social/jwt-sliding/
POST /api/login/social/jwt-sliding-user/
Check docs of simplejwt for pair/sliding token difference.
Note. django-rest-framework-simplejwt doesn't work on python3.6
5.4 knox authentication
POST /api/login/social/knox/
POST /api/login/social/knox_user/
Similar to token authentication, but token is Django Rest Knox Token.
To use it, django-rest-knox must be installed.
User model is taken from settings.AUTH_USER_MODEL.
At input there is also non-required field redirect_uri.
If given, server will use this redirect uri in requests, instead of uri
got from settings.
This redirect_uri must be equal in front-end request and in back-end request.
Back-end will not do any redirect in fact.
It is also possible to specify provider in URL, not in request body. Just append it to the url:
POST /api/login/social/session/facebook/
Don't need to specify it in body now:
{
"code": "AQBPBBTjbdnehj51"
}
Provider defined in URL has higher priority than provider in body. If both are specified - provider will be taken from URL.
Front-end need to know following params for each social provider:
Front-end redirect user to social authorize url with params from previous point.
User confirms.
Social provider redirects back to redirect_uri with param code.
Front-end now ready to login the user. To do it, send POST request with provider name and code:
POST /api/login/social/session/
with data (form data or json)
provider=facebook&code=AQBPBBTjbdnehj51
Backend will either signin the user, either signup, either return error.
Sometimes it is more suitable to specify provider in url, not in request body. It is possible, rest-social-auth will understand that. Following request is the same as above:
POST /api/login/social/session/facebook/
with data (form data or json)
code=AQBPBBTjbdnehj51
Front-end needs to make a POST request to your backend with the provider name ONLY:
POST /api/login/social/
with data (form data or json):
provider=twitter
Or specify provider in url, in that case data will be empty:
POST /api/login/social/twitter
The backend will return a short-lived oauth_token request token in the response. This can be used by the front-end to perform authentication with the provider.
User confirms. In the case of Twitter, they will then return the following data to your front-end:
{
"redirect_state": "...bHrz2x0wy43",
"oauth_token" : "...AAAAAAAhD5u",
"oauth_verifier": "...wDBdTR7CYdR"
}
Front-end now ready to login the user. To do it, send POST request again with provider name and the oauth_token and oauth_verifier you got from the provider:
POST /api/login/social/
with data (form data or json)
provider=twitter&oauth_token=AQBPBBTjbdnehj51&oauth_verifier=wDBdTR7CYdR
Backend will either signin the user, or signup, or return an error. Same as in OAuth 2.0, you can specify provider in url, not in body:
POST /api/login/social/twitter
This flow is the same as described in satellizer. This angularjs module is used in example project.
As we can see, our backend must implement resource for signin the user.
Django REST social auth provides means to easily implement such resource.
OAuth 1.0 and OAuth 2.0 providers are supported.
Look python-social-auth for full list.
Name of provider is taken from corresponding backend.name property of
particular backed class in python-social-auth.
For example for facebook backend we see:
class FacebookOAuth2(BaseOAuth2):
name = 'facebook'
Here are some provider names:
| Provider | provider name |
|---|---|
| google-oauth2 | |
| Vkontakte | vk-oauth2 |
| Github | github |
| Yandex | yandex-oauth2 |
| Others | ... |
REST_SOCIAL_OAUTH_REDIRECT_URI
Default: '/'
Defines redirect_uri. This redirect must be the same in both authorize request (made by front-end) and access token request (made by back-end) to OAuth provider.
To override the relative path (url path or url name are both supported):
REST_SOCIAL_OAUTH_REDIRECT_URI = '/oauth/redirect/path/'
# or url name
REST_SOCIAL_OAUTH_REDIRECT_URI = 'redirect_url_name'
Note, in case of url name, backend name will be provided to url resolver as argument.
REST_SOCIAL_DOMAIN_FROM_ORIGIN
Default: True
Sometimes front-end and back-end are run on different domains. For example frontend at 'myproject.com', and backend at 'api.myproject.com'.
If True, domain will be taken from request origin, if origin is defined.
So in current example domain will be 'myproject.com', not 'api.myproject.com'.
Next, this domain will be joined with path from REST_SOCIAL_OAUTH_REDIRECT_URI settings.
To be clear, suppose we have following settings (defaults):
REST_SOCIAL_OAUTH_REDIRECT_URI = '/'
REST_SOCIAL_DOMAIN_FROM_ORIGIN = True
Front-end is running on domain 'myproject.com', back-end - on 'api.myproject.com'. Back-end will use following redirect_uri:
myproject.com/
And with following settings:
REST_SOCIAL_OAUTH_REDIRECT_URI = '/'
REST_SOCIAL_DOMAIN_FROM_ORIGIN = False
redirect_uri will be:
api.myproject.com/
Also look at django-cors-headers if such architecture is your case.
REST_SOCIAL_OAUTH_ABSOLUTE_REDIRECT_URI
Default: None
Full redirect uri (domain and path) can be hardcoded
REST_SOCIAL_OAUTH_ABSOLUTE_REDIRECT_URI = 'http://myproject.com/'
This settings has higher priority than REST_SOCIAL_OAUTH_REDIRECT_URI and REST_SOCIAL_DOMAIN_FROM_ORIGIN.
I.e. if this settings is defined, other will be ignored.
But redirect_uri param from request has higher priority than any setting.
REST_SOCIAL_LOG_AUTH_EXCEPTIONS
Default: True
When False will not log social auth authentication exceptions.
REST_SOCIAL_VERBOSE_ERRORS
Default: False
When True the API will return error message received from server. Can be potentially unsecure to turn it ON.
SOCIAL_AUTH_STRATEGY
Default: 'rest_social_auth.strategy.DRFStrategy'
Override strategy for python-social-auth.
First of all, customization provided by python-social-auth is also avaliable. For example, use nice mechanism of pipeline to do any action you need during login/signin.
Second, you can override any method from current package. Specify serializer for each view by subclassing the view.
To do it
define your own url:
path('api/login/social/$', MySocialView.as_view(), name='social_login'),
define your serializer
from rest_framework import serializers
from django.contrib.auth import get_user_model
class MyUserSerializer(serializers.ModelSerializer):
class Meta:
model = get_user_model()
exclude = ('password', 'user_permissions', 'groups')
define view
from rest_social_auth.views import SocialSessionAuthView
from .serializers import MyUserSerializer
class MySocialView(SocialSessionAuthView):
serializer_class = MyUserSerializer
Check the code of the lib, there is not much of it.
There is an example project.
clone repo
git clone https://github.com/st4lk/django-rest-social-auth.git
run example project
make
It is assumed, that you have:
open https://127.0.0.1:8000/ in your browser
Note: runsslserver is used instead of built-in runserver to serve the project with TLS (aka SSL) certificate.
HTTPS is required by some social providers (facebook), without it they won't work.
The certificate will not be trusted by your system - that is expected.
Just tell your browser to proceed with this untrusted certificate - it is acceptable for development purposes.
In Chrome browser it can look like this:
More details here.
Facebook, Google and Twitter auth should work, all secret keys are already set.
Example project uses satellizer angularjs module.
Run tests locally
make test
Run tests in all enviroments (can take some time)
make test-tox
Thanks to all contributors!
REST_SOCIAL_VERBOSE_ERRORS settingpath() django function instead of deprecated url()djangorestframework-jwt dependencyIssues: #137
Issues: #121
Issues: #110
Issues: #104, #106
Issues: #74
Issues: #73
Issues: #70
Issues: #58
Issues #54
REST_SOCIAL_LOG_AUTH_EXCEPTIONSIssues #42
Issues: #33, #35, #37, #38
Issues: #28
Issues: #22, #25
Issues: #20
Issues: #11, #17, #14
Issues: #6
Issues: #2, #3, #5
First version in pypi
FAQs
Django rest framework resources for social auth
We found that rest-social-auth demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.
Security News
Research
Socket researchers found a malicious Maven package impersonating the legitimate ‘XZ for Java’ library, introducing a backdoor for remote code execution.