Django Rest Framework: JWT Authorization failed

Question

I have an application wrote with Django REST Framework (DRF). Also, there are such registered endpoints:

from refreshtoken.views import delegate_jwt_token
from rest_framework_jwt.views import obtain_jwt_token

urlpatterns = [
    path('api-token-auth/', obtain_jwt_token),
    path('api-auth/', include('rest_framework.urls', namespace='rest_framework')),
    path(r'refresh-token', delegate_jwt_token, name='refresh-token'),
]

Also, there are some endpoints, which requires authorization.

So, I'm trying to extract my token using curl client:

curl -X POST -H "Content-Type: application/json" http://127.0.0.1:8000/api-token-auth/ -d '{"username": "test", "password": "testpassword"}'

It returns something like this:

{"token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiYTdlMmIyMjItZTZkNy00NjhiLTkxNzYtOTE2YzAwZWRhY2E2IiwidXNlcm5hbWUiOiJ0ZXN0IiwiZXhwIjoxNTUwNTEwNDAwLCJlbWFpbCI6InRlc3RAZHhhbXBsZS5jb20iLCJpc19zdGFmZiI6ZmFsc2UsImdyb3VwcyI6W10sInN1YnNjcmliZWQiOmZhbHNlLCJ0ZWxlZ3JhbV9zdWJzY3JpYmVkIjpmYWxzZX0.OExR9TlO3GUisYAu_D86CJ6hgF1EcofpQA0MZ1ENT2c","refresh_token":"1ab03e609d7a7ae05ce104c73858a346a0438e72"}

Then, using this token I want to login, using token:

curl -X POST -H "Authorization: JWT eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiYTdlMmIyMjItZTZkNy00NjhiLTkxNzYtOTE2YzAwZWRhY2E2IiwidXNlcm5hbWUiOiJ0ZXN0IiwiZXhwIjoxNTUwNTEwNDAwLCJlbWFpbCI6InRlc3RAZHhhbXBsZS5jb20iLCJpc19zdGFmZiI6ZmFsc2UsImdyb3VwcyI6W10sInN1YnNjcmliZWQiOmZhbHNlLCJ0ZWxlZ3JhbV9zdWJzY3JpYmVkIjpmYWxzZX0.OExR9TlO3GUisYAu_D86CJ6hgF1EcofpQA0MZ1ENT2c" -H "Content-Type: application/json" http://127.0.0.1:8000/api-auth/login/ -d '{"username": "test", "password": "testpassword"}'

It returns 403 (Forbidden)CSRF verification failed. Request aborted.

Why I'm doing wrong?

One interesting point here:

Each request for the token returns a new token for the same user:password pair (is it expected or my token expires too fast)?

Try without JWT word just the token.

Eddwin Paz
– Eddwin Paz

2019-02-18 17:21:34 +00:00
Commented Feb 18, 2019 at 17:21 — Eddwin Paz
– Eddwin Paz, Commented Feb 18, 2019 at 17:21
Could you show us the DEFAULT_AUTHENTICATION_CLASSES?

Kristiyan Gospodinov
– Kristiyan Gospodinov

2019-02-18 17:32:16 +00:00
Commented Feb 18, 2019 at 17:32 — Kristiyan Gospodinov
– Kristiyan Gospodinov, Commented Feb 18, 2019 at 17:32

gdef_ · Accepted Answer · 2019-02-18 17:59:38Z

Once you have the token you don't need to pass the login credentials or go to the login url like you are trying, the token will provide the authentication. Try accessing a protected url like in the docs example:

Now in order to access protected api urls you must include the Authorization: JWT header.

$ curl -H "Authorization: JWT <your_token>" http://localhost:8000/protected-url/

Make sure you added 'rest_framework_jwt.authentication.JSONWebTokenAuthentication' to 'DEFAULT_AUTHENTICATION_CLASSES' like in the docs.

REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
    ),
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework_jwt.authentication.JSONWebTokenAuthentication',
        'rest_framework.authentication.SessionAuthentication',
        'rest_framework.authentication.BasicAuthentication',
    ),
}

Regarding your last question:

Each request for the token returns a new token for the same user:password pair (is it expected or my token expires too fast)?

That's expected, every time you call /api-token-auth/ you are generating a new one. The default expiration is 5 minutes, you can change it in the settings using JWT_EXPIRATION_DELTA. Check additional settings.

Collectives™ on Stack Overflow

Django Rest Framework: JWT Authorization failed

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related