Bài 7.1: Authentication in DRF - Phần 1 - Authentication Basics

**Series Navigation:** - **Bài 7.1 (bài này): Authentication Basics** 👈 - [Bài 7.2: Token Authentication Advanced](/django-advance/authentication-drf-phan-2) - [Bài 7.3: JWT Authentication](/django-advance/authentication-drf-phan-3) - [Bài 7.4: OAuth2 & Social Auth](/django-advance/authentication-drf-phan-4)

Mục Tiêu Bài 7.1

Sau khi hoàn thành Bài 7.1 này, bạn sẽ:

✅ Hiểu authentication flow trong DRF
✅ Master authentication classes
✅ Implement SessionAuthentication
✅ Implement TokenAuthentication
✅ Implement BasicAuthentication
✅ Configure authentication globally và per-view
✅ Handle authentication errors
✅ Test authentication

Authentication Overview

What is Authentication?

Authentication = Xác định user là ai.

Authorization = Xác định user có quyền gì.

Authentication → "Who are you?"Authorization  → "What can you do?"

Authentication vs Authorization

# Authentication: Identify userrequest.user  # Who is making the request? # Authorization: Check permissionsif request.user.is_staff:  # What can they do?    # Allow access

Example:

User: john@example.comPassword: ******** 1. Authentication: Verify john@example.com exists and password is correct2. Authorization: Check if john can access /api/articles/

DRF Authentication Flow

1. Request arrives   ↓2. DRF runs authentication classes   ↓3. Sets request.user and request.auth   ↓4. View runs permission checks   ↓5. View logic executes   ↓6. Response returned

Code flow:

class ArticleViewSet(viewsets.ModelViewSet):    authentication_classes = [SessionAuthentication, TokenAuthentication]    permission_classes = [IsAuthenticated]        def list(self, request):        # At this point:        # - request.user is set (authenticated user or AnonymousUser)        # - request.auth is set (Token, Session, etc.)        # - Permissions checked (IsAuthenticated passed)                # View logic        articles = Article.objects.filter(author=request.user)        serializer = ArticleSerializer(articles, many=True)        return Response(serializer.data)

request.user and request.auth

request.user:

# Authenticated requestrequest.user  # User instance (e.g., User object)request.user.is_authenticated  # Truerequest.user.username  # 'john' # Unauthenticated requestrequest.user  # AnonymousUserrequest.user.is_authenticated  # False

request.auth:

# Token authenticationrequest.auth  # Token instance # Session authenticationrequest.auth  # None (session-based) # JWT authenticationrequest.auth  # JWT token payload

Authentication Classes

Built-in Authentication Classes

DRF provides 4 authentication classes:

SessionAuthentication - Django session-based
BasicAuthentication - HTTP Basic Auth
TokenAuthentication - Token-based
RemoteUserAuthentication - External authentication

How Authentication Classes Work

Authentication class structure:

from rest_framework.authentication import BaseAuthentication class CustomAuthentication(BaseAuthentication):    def authenticate(self, request):        """        Returns:        - (user, auth) tuple if authenticated        - None if not authenticated                Raises:        - AuthenticationFailed if invalid credentials        """        # Get credentials from request        token = request.META.get('HTTP_AUTHORIZATION')                if not token:            return None  # No credentials provided                # Validate credentials        try:            user = User.objects.get(auth_token=token)            return (user, token)  # Success        except User.DoesNotExist:            raise AuthenticationFailed('Invalid token')

Return values:

(user, auth) → Authentication successful
None → No authentication attempted (try next class)
AuthenticationFailed exception → Invalid credentials

Configuring Authentication

Global configuration:

# settings.pyREST_FRAMEWORK = {    'DEFAULT_AUTHENTICATION_CLASSES': [        'rest_framework.authentication.SessionAuthentication',        'rest_framework.authentication.TokenAuthentication',    ]}

Per-view configuration:

from rest_framework.authentication import SessionAuthentication, TokenAuthentication class ArticleViewSet(viewsets.ModelViewSet):    authentication_classes = [SessionAuthentication, TokenAuthentication]    # ...

Per-method decorator:

from rest_framework.decorators import api_view, authentication_classesfrom rest_framework.authentication import TokenAuthentication @api_view(['GET'])@authentication_classes([TokenAuthentication])def article_list(request):    # Only token authentication    pass

Disable authentication:

class PublicArticleList(generics.ListAPIView):    authentication_classes = []  # No authentication required    permission_classes = []    # ...

SessionAuthentication

What is SessionAuthentication?

SessionAuthentication = Uses Django's session framework.

How it works:

User logs in via Django auth
Session ID stored in cookie
DRF validates session on each request

Benefits:

✅ Integrates with Django auth
✅ Works with Django admin
✅ Familiar login/logout flow
✅ CSRF protection

Limitations:

❌ Not suitable for mobile apps
❌ Requires cookies
❌ CSRF tokens needed

Setup

Install:

# settings.pyINSTALLED_APPS = [    'django.contrib.sessions',  # Already installed by default    'rest_framework',] MIDDLEWARE = [    'django.contrib.sessions.middleware.SessionMiddleware',  # Already there    'django.middleware.csrf.CsrfViewMiddleware',  # Already there] REST_FRAMEWORK = {    'DEFAULT_AUTHENTICATION_CLASSES': [        'rest_framework.authentication.SessionAuthentication',    ]}

Login/Logout Views

Using DRF's built-in views:

# urls.pyfrom django.urls import path, include urlpatterns = [    path('api-auth/', include('rest_framework.urls')),  # Login/Logout views]

Custom login view:

# views.pyfrom django.contrib.auth import authenticate, login, logoutfrom rest_framework.decorators import api_view, permission_classesfrom rest_framework.permissions import AllowAnyfrom rest_framework.response import Response @api_view(['POST'])@permission_classes([AllowAny])def login_view(request):    username = request.data.get('username')    password = request.data.get('password')        user = authenticate(username=username, password=password)        if user is not None:        login(request, user)        return Response({            'message': 'Login successful',            'user': {                'id': user.id,                'username': user.username,                'email': user.email,            }        })    else:        return Response({'error': 'Invalid credentials'}, status=400) @api_view(['POST'])def logout_view(request):    logout(request)    return Response({'message': 'Logout successful'})

CSRF Protection

SessionAuthentication requires CSRF tokens:

Get CSRF token:

from django.middleware.csrf import get_tokenfrom rest_framework.decorators import api_view, permission_classesfrom rest_framework.permissions import AllowAny @api_view(['GET'])@permission_classes([AllowAny])def csrf_token_view(request):    return Response({'csrfToken': get_token(request)})

Use in requests:

// JavaScript clientfetch('/api/articles/', {    method: 'POST',    headers: {        'Content-Type': 'application/json',        'X-CSRFToken': csrfToken,  // From cookie or API    },    credentials: 'include',  // Include cookies    body: JSON.stringify(data)})

CSRF exemption (not recommended):

from django.views.decorators.csrf import csrf_exempt @csrf_exempt@api_view(['POST'])def unsafe_view(request):    # CSRF not checked - dangerous!    pass

Example with SessionAuthentication

# views.pyfrom rest_framework import viewsetsfrom rest_framework.authentication import SessionAuthenticationfrom rest_framework.permissions import IsAuthenticated class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    authentication_classes = [SessionAuthentication]    permission_classes = [IsAuthenticated]        def perform_create(self, serializer):        serializer.save(author=self.request.user) # urls.pyfrom django.urls import path, includefrom rest_framework.routers import DefaultRouter router = DefaultRouter()router.register('articles', ArticleViewSet) urlpatterns = [    path('api/', include(router.urls)),    path('api-auth/', include('rest_framework.urls')),  # Login UI]

Testing:

# 1. Login via browser at http://localhost:8000/api-auth/login/# 2. Make authenticated requests:curl http://localhost:8000/api/articles/ \  -H "Cookie: sessionid=xxx" \  -H "X-CSRFToken: yyy"

BasicAuthentication

What is BasicAuthentication?

BasicAuthentication = HTTP Basic Auth with username:password in header.

How it works:

Client sends Authorization: Basic base64(username:password)
DRF decodes and validates credentials
Sets request.user

Benefits:

✅ Simple implementation
✅ No additional setup
✅ Works everywhere

Limitations:

❌ Credentials sent with every request
❌ Must use HTTPS (credentials in header)
❌ No logout mechanism
❌ Not suitable for production

Use cases:

Development/testing
Internal APIs
Quick prototyping

Setup

# settings.pyREST_FRAMEWORK = {    'DEFAULT_AUTHENTICATION_CLASSES': [        'rest_framework.authentication.BasicAuthentication',    ]}

Using BasicAuthentication

# views.pyfrom rest_framework.authentication import BasicAuthenticationfrom rest_framework.permissions import IsAuthenticated class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    authentication_classes = [BasicAuthentication]    permission_classes = [IsAuthenticated]

Request example:

# Username: john, Password: secret123# base64("john:secret123") = "am9objpzZWNyZXQxMjM=" curl http://localhost:8000/api/articles/ \  -H "Authorization: Basic am9objpzZWNyZXQxMjM=" # Or with curl shorthand:curl -u john:secret123 http://localhost:8000/api/articles/

Python requests:

import requestsfrom requests.auth import HTTPBasicAuth response = requests.get(    'http://localhost:8000/api/articles/',    auth=HTTPBasicAuth('john', 'secret123'))

Security Considerations

⚠️ ALWAYS use HTTPS with BasicAuthentication:

# settings.pyif not DEBUG:    # Force HTTPS in production    SECURE_SSL_REDIRECT = True    SESSION_COOKIE_SECURE = True    CSRF_COOKIE_SECURE = True

Limit BasicAuth to specific views:

# Only use for development endpointsclass DebugViewSet(viewsets.ReadOnlyModelViewSet):    authentication_classes = [BasicAuthentication]    permission_classes = [IsAdminUser]    # ...

TokenAuthentication

What is TokenAuthentication?

TokenAuthentication = Simple token-based auth with rest_framework.authtoken.

How it works:

User logs in with credentials
Server generates and returns token
Client includes token in subsequent requests
Server validates token

Benefits:

✅ Stateless
✅ Suitable for mobile/SPA
✅ No cookies/sessions
✅ Simple implementation

Limitations:

❌ No expiration (unless custom)
❌ Single token per user
❌ Token stored in database (performance)

Setup

Install:

# settings.pyINSTALLED_APPS = [    'rest_framework',    'rest_framework.authtoken',  # Add this] REST_FRAMEWORK = {    'DEFAULT_AUTHENTICATION_CLASSES': [        'rest_framework.authentication.TokenAuthentication',    ]}

Migrate:

python manage.py migrate

Creates table:

authtoken_token (    key: CharField(40, primary_key=True)    user_id: OneToOneField(User)    created: DateTimeField(auto_now_add=True))

Generating Tokens

Method 1: Auto-generate on user creation

# signals.pyfrom django.conf import settingsfrom django.db.models.signals import post_savefrom django.dispatch import receiverfrom rest_framework.authtoken.models import Token @receiver(post_save, sender=settings.AUTH_USER_MODEL)def create_auth_token(sender, instance=None, created=False, **kwargs):    if created:        Token.objects.create(user=instance)

Method 2: Manual generation

from rest_framework.authtoken.models import Token # Create token for usertoken = Token.objects.create(user=user)print(token.key)  # '9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b' # Get or createtoken, created = Token.objects.get_or_create(user=user) # Regenerate tokentoken.delete()token = Token.objects.create(user=user)

Method 3: Via management command

python manage.py drf_create_token <username>

Obtain token:

# urls.pyfrom rest_framework.authtoken.views import obtain_auth_token urlpatterns = [    path('api/token/', obtain_auth_token, name='api_token_auth'),]

Request:

curl -X POST http://localhost:8000/api/token/ \  -d "username=john&password=secret123"

Response:

{    "token": "9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b"}

Custom login view:

# views.pyfrom django.contrib.auth import authenticatefrom rest_framework.decorators import api_view, permission_classesfrom rest_framework.permissions import AllowAnyfrom rest_framework.response import Responsefrom rest_framework.authtoken.models import Token @api_view(['POST'])@permission_classes([AllowAny])def login(request):    username = request.data.get('username')    password = request.data.get('password')        user = authenticate(username=username, password=password)        if user:        token, created = Token.objects.get_or_create(user=user)        return Response({            'token': token.key,            'user': {                'id': user.id,                'username': user.username,                'email': user.email,            }        })        return Response({'error': 'Invalid credentials'}, status=400) @api_view(['POST'])def logout(request):    # Delete token    request.user.auth_token.delete()    return Response({'message': 'Logout successful'})

Using Token in Requests

Authorization header:

curl http://localhost:8000/api/articles/ \  -H "Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b"

Python requests:

import requests headers = {    'Authorization': 'Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b'} response = requests.get('http://localhost:8000/api/articles/', headers=headers)

JavaScript:

fetch('http://localhost:8000/api/articles/', {    headers: {        'Authorization': 'Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b'    }})

Complete Token Authentication Example

# settings.pyINSTALLED_APPS = [    'rest_framework',    'rest_framework.authtoken',] REST_FRAMEWORK = {    'DEFAULT_AUTHENTICATION_CLASSES': [        'rest_framework.authentication.TokenAuthentication',    ],    'DEFAULT_PERMISSION_CLASSES': [        'rest_framework.permissions.IsAuthenticated',    ],} # views.pyfrom rest_framework import viewsetsfrom rest_framework.authentication import TokenAuthenticationfrom rest_framework.permissions import IsAuthenticated class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    authentication_classes = [TokenAuthentication]    permission_classes = [IsAuthenticated]        def perform_create(self, serializer):        serializer.save(author=self.request.user) # urls.pyfrom django.urls import path, includefrom rest_framework.routers import DefaultRouterfrom rest_framework.authtoken.views import obtain_auth_token router = DefaultRouter()router.register('articles', ArticleViewSet) urlpatterns = [    path('api/', include(router.urls)),    path('api/login/', obtain_auth_token),]

Usage flow:

# 1. Logincurl -X POST http://localhost:8000/api/login/ \  -d "username=john&password=secret123"# Returns: {"token": "abc123..."} # 2. Use token in requestscurl http://localhost:8000/api/articles/ \  -H "Authorization: Token abc123..." # 3. Create articlecurl -X POST http://localhost:8000/api/articles/ \  -H "Authorization: Token abc123..." \  -H "Content-Type: application/json" \  -d '{"title": "New Article", "content": "..."}'

Multiple Authentication Classes

Combining Authentication Methods

class ArticleViewSet(viewsets.ModelViewSet):    authentication_classes = [        SessionAuthentication,  # For browser        TokenAuthentication,    # For API clients    ]    permission_classes = [IsAuthenticated]    # ...

How it works:

Try SessionAuthentication first
If returns None, try TokenAuthentication
If returns None, user is unauthenticated
If any raises AuthenticationFailed, stop

Order Matters

# Good: Try token first (faster)authentication_classes = [TokenAuthentication, SessionAuthentication] # Bad: Try session first (slower for API clients)authentication_classes = [SessionAuthentication, TokenAuthentication]

Conditional Authentication

class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer        def get_authenticators(self):        """Dynamic authentication based on action"""        if self.action in ['list', 'retrieve']:            # Public read access (no auth required)            return []        else:            # Write operations require auth            return [TokenAuthentication(), SessionAuthentication()]

Testing Authentication

Testing with APIClient

# tests.pyfrom rest_framework.test import APITestCasefrom rest_framework.authtoken.models import Tokenfrom django.contrib.auth.models import User class AuthenticationTest(APITestCase):    def setUp(self):        self.user = User.objects.create_user('testuser', 'test@test.com', 'password')        self.token = Token.objects.create(user=self.user)        def test_token_authentication(self):        """Test token authentication"""        # Without token        response = self.client.get('/api/articles/')        self.assertEqual(response.status_code, 401)                # With token        self.client.credentials(HTTP_AUTHORIZATION=f'Token {self.token.key}')        response = self.client.get('/api/articles/')        self.assertEqual(response.status_code, 200)        def test_session_authentication(self):        """Test session authentication"""        # Login        self.client.login(username='testuser', password='password')                # Authenticated request        response = self.client.get('/api/articles/')        self.assertEqual(response.status_code, 200)                # Logout        self.client.logout()        response = self.client.get('/api/articles/')        self.assertEqual(response.status_code, 401)        def test_force_authenticate(self):        """Test with force_authenticate"""        # Force authentication (bypasses all auth)        self.client.force_authenticate(user=self.user)        response = self.client.get('/api/articles/')        self.assertEqual(response.status_code, 200)

Tóm Tắt Bài 7.1

Trong Bài 7.1 này, bạn đã học:

✅ Authentication Basics:

Authentication vs Authorization
Authentication flow trong DRF
request.user và request.auth

✅ Authentication Classes:

How authentication classes work
Configuring authentication (global, per-view, per-method)
Multiple authentication classes

✅ SessionAuthentication:

Django session-based auth
Login/logout views
CSRF protection
Use cases and limitations

✅ BasicAuthentication:

HTTP Basic Auth
Setup and usage
Security considerations
When to use/avoid

✅ TokenAuthentication:

Token-based auth setup
Generating tokens
Login/logout endpoints
Using tokens in requests
Complete example

✅ Testing:

Testing authentication with APIClient
force_authenticate helper

Next Steps

Trong Bài 7.2, bạn sẽ học:

Custom token authentication
Token expiration
Multiple tokens per user
Token refresh patterns
Token security best practices
Custom authentication classes

Navigation:

← Bài 6.3: Advanced ViewSet Patterns
Bài 7.1: Authentication Basics (current)
Bài 7.2: Token Authentication Advanced →

#session-auth

Authentication in DRF - Phần 1 - Authentication Basics