jamesritchie / django-rest-framework-expiring-tokens

Expiring Token Auth for Django Rest Framework

Expiring Tokens for Django Rest Framework

This package provides a lightweight extension to the included token authentication in Django Rest Framework, causing tokens to expire after a specified duration.

This behaviour is good practice when using token authentication for production APIs. If you require more complex token functionality, you're probably better off looking at one of the OAuth2 implementations available for Django Rest Framework.

This package was inspired by this Stack Overflow answer.

Installation

Expiring Tokens is tested against the latest versions of Django 1.6, 1.7 and the 1.8 preview release, and Django Rest Framework 3.1.1. It should in theory support Django 1.4.

Grab the package from PyPI.

pip install djangorestframework-expiring-authtoken

As this package uses a proxy model on the original Token model, the first step is to setup the default TokenAuthentication scheme, and check that it works.

Then, add the package to INSTALLED_APPS along with rest_framework.authtoken in settings.py.

INSTALLED_APPS = [
    ...
    'rest_framework',
    'rest_framework.authtoken',
    'rest_framework_expiring_authtoken',
    ...
]

Specify the desired lifespan of a token with EXPIRING_TOKEN_LIFESPAN in settings.py using a timedelta object. If not set, the default is 30 days.

import datetime
EXPIRING_TOKEN_LIFESPAN = datetime.timedelta(days=25)

Set the authentication scheme to rest_framework_expiring_authtoken.authentication.ExpiringTokenAuthentication on a default or per-view basis.

If you used the obtain_auth_token view, you'll need to replace it with the obtain_expiring_auth_token view in your URLconf.

from rest_framework_expiring_authtoken import views
urlpatterns += [
    url(r'^api-token-auth/', views.obtain_expiring_auth_token)
]

If using Django 1.7 or later, you'll need to run migrate, even though nothing is changed, as Django requires proxy models that inherit from models in an app with migrations to also have migrations.

python manage.py migrate

## Usage

Expiring Tokens works exactly the same as the default TokenAuth, except that using an expired token will return a response with an HTTP 400 status and a Token has expired error message.

The obtain_expiring_auth_token view works exactly the same as the obtain_auth_token view, except it will replace existing tokens that have expired with a new token.

Improvements

• Variable token lifespans.
• Possibly change obtain_expiring_auth_token to always replace an existing token. (Configurable?)
• South Migrations

Contributors

• James Ritchie
• fcasas

## Changelog

• 0.1.4
• Fixed a typo causing an incorrect 500 error response with an invalid token.
• Support Django 1.10 and Django Rest Framework 3.4
• 0.1.3
• Set a default token lifespan of 30 days.
• 0.1.2
• Changed from deprecated request.DATA to request.data
• 0.1.1
• Initial release

django-rest-framework-expiring-tokens's Issues

The Token Does Not Expire

I add the:
EXPIRING_TOKEN_LIFESPAN = timedelta(minutes=1)
to test, and I did 2 GETs with a 3 minute break.

The token has not expired / changed.

Exception raised when a wrong auth token provided

https://github.com/JamesRitchie/django-rest-framework-expiring-tokens/blob/master/rest_framework_expiring_authtoken/authentication.py#L27

authentication.py line 27:
except self.model.DoesNotExist: should be except self.models.DoesNotExist: note the missing s of models

Feature request: whitelist of user which token never expire

I don't know if is it already possible, but i have a server 2 server user and i don't want that its token expires

0.1.4 Release

• Cover supported Django and Python versions
• Put an upper bound on required DRF version
• Update Changelog
• Credit PR authors
• Increment version number
• Release to PyPI

Renew Time Token

Hi guys!

It's possible renew time of token on each requests?

[feature] token of dynamic expiring time

Thanks for your work! I am using it in my Django Restful API project. And I found it would me much more helpful if the token can have dynamic expiring time instead of static setting. However, I found you are using a proxy model. Maybe it can only be implemented through creating a actual model with new field of lifespan.
Waiting for your cleverer solutions.
Thx~

[Advice] Returns expired datetime in response

Hi,

I've used this project in a small project and it works fine. I've stored the returned token in browser's localStorage for logined user.

I'm thinking about how to validate token. For example, if token is expired, then the server will returns a HTTP 403 Forbidden message, so the browser can check the response body and search for expired string, then make another request with username/password to get a new token.

I think a better way to do this is, return the expired date time with token, then the browser can check the validation of token by hand instead of getting a HTTP 403 Forbidden.

How do you think about this?

Token expired

My token expired. What can I do if my account has expired? Either I forget a project I've already started (work wasted) or I create a new project. How do I get back to Rasa+Botfront ?

AttributeError when no EXPIRING_TOKEN_LIFESPAN in settings.py file

When I've commented out the EXPIRING_TOKEN_LIFESPAN value in my settings.py file for some testing, this came up

Exception Type: AttributeError
Exception Value: Settings object has no attribute EXPIRING_TOKEN_LIFESPAN
Exception Location: /home/user/.envs/content/local/lib/python2.7/site-packages/django/conf/__init__.py in __getattr__, line 49
Python Version: 2.7.6

HTTP status code should be 401 for expired token

The Read Me document states:

Expiring Tokens works exactly the same as the default TokenAuth, except that using an expired token will return a response with an HTTP 400 status and a Token has expired error message.

HTTP response status code 400 means “Bad request”, as in a malformed request. This does not seem appropriate for a well-formed request with expired authentication.

Instead, the response status code 401 “Unauthorized” is more appropriate. The message “Token has expired” can still be in the response body to explain why the authentication failed.

(Reference for HTTP response codes, temporary errors)

request.DATA is deprecated in favor of request.data

Line 22 in view.py serializer = AuthTokenSerializer(data=request.DATA)
should be serializer = AuthTokenSerializer(data=request.data)