How to use OAuth2 within django-rest-framework?

Question

I've been trying to integrate OAuth2 authentication in my drf application. Given I don't yet need a front-end for my app, I was using the browsable API. DRF and the OAuth2 provider package are supposed to work together without much configuration, as explained in the tutorial.

I should mention that all the steps from the tutorial are working (so I can access the app from the command line) but when I try to do it from the browsable API, I don't see any request for an access token or anything like that.

I think that DRF does not actually provide the flow for the front-end part of authentication by OAuth2, but I was just wondering if someone managed to make it work (because for now I am using SessionAuthentication).

Thanks.

I have similar problem - did you manage to run DRF+OAuth2+Angularjs ? — pplonski
– pplonski, Commented Sep 1, 2016 at 16:27
@pplonski : yes, I did. I used a 3rd party library in my django project in order to have the OAuth functionality. This comes as a completion of DRF and is NOT a part of the API I built with DRF. So I can not login into the browsable API using OAuth2. Within Angular, I used restangular, which is great for requests. Basically, I make a call to get an access token, and set it as a header in restangular. All further requests are 'authenticated'. If you have any more questions or need some code, I'll be glad to help. — AdelaN
– AdelaN, Commented Sep 2, 2016 at 7:46
thank you! so, you wrote by your own Angular code to handle OAuth authorization - did you try to use for example github.com/Tivix/angular-django-registration-auth ? — pplonski
– pplonski, Commented Sep 2, 2016 at 8:26
@pplonski Yes, I pretty much wrote the code, inspired from a tutorial like this one : medium.com/opinionated-angularjs/…. As far as I can tell, your example is pretty similar to what I did : request a token, keep the obtained token in session/cookies and also set it as a header so that it is used on subsequent requests. I am currently working on making my implementation less error-prone. — AdelaN
– AdelaN, Commented Sep 5, 2016 at 9:58

Kevin Brown-Silva · Accepted Answer · 2015-02-26 17:25:39Z

1

OAuth2, unlike basic authentication and cookie-based authentication, does not easily work within the browser. When authenticating requests, it relies on the Authorization header being present (with the OAuth type) and there is no way using a browser to easily fill that in.

Session authentication relies on cookies, which most browsers easily support, and is recommended for interacting with APIs that are on the same domain as the front end.

Basic authentication also relies on the Authorization header, but uses the Basic type which is supported by most browsers.

answered Feb 26, 2015 at 17:25

Kevin Brown-Silva

41.8k42 gold badges207 silver badges243 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

AdelaN Over a year ago

Ok, this clarifies a lot of things (and confirms the fact that DRF's API will never use OAuth2). But I'm still a bit confused about how will this work in the final, real-life app (in which I am planning to use Angular).

user7993009 Over a year ago

To add to everyone observations, there is a clear lack of online resources that show how to implement DRF oauth2 with a browser mobile front end (React, Angluar, etc).

Collectives™ on Stack Overflow

How to use OAuth2 within django-rest-framework?

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related