Protect a Django REST api with Oauth2

Lightning talk for pycon15

Transcript

1. Protect a Django REST
   API with OAuth2
   Massimiliano Pippi @maxpippi
   

   View Slide

2. Introducing my friend Harold
   Let’s say we want to
   write a timetracking
   web application
   y u not pushing?
   git push -f works lol
   

   View Slide

3. Backend recipe
   Django
   &
   Django REST
   Framework
   u can use the new DRF3 generic views here
   wut?
   

   View Slide

4. Projects proliferation
   timetracker-backend
   timetracker-web
   timetracker-[android|ios]
   timetracker-desktop
   yep! I need an app for my nokia 3210
   

   View Slide

5. How do we do access control?
   Third party apps
   want to access
   our data as well!
   not ma problem can’t hear u
   

   View Slide

6. Common problems
   ● Using user credentials inside the app is a
   bad idea
   ● The app might have full access to user
   account
   ● User has to change his password to
   revoke the access
   

   View Slide

7. Multiple problems - one Solution
   The OAuth2
   framework
   omg not oauth again
   

   View Slide

8. Django OAuth Toolkit
   ● Django 1.4 → 1.7 (1.8 coming soon)
   ● Python 2&3
   ● built on top of oauthlib, RFC 6749
   compliant
   ● DRF 2&3 integration
   https://github.com/evonove/django-oauth-toolkit
   

   View Slide

9. Batteries included
   ● builtin views to
   register and
   manage OAuth2
   applications
   ● form view for user
   authorization
   lol I found what DRF stands for
   omg harold plz retire
   

   View Slide

10. Endpoints protection for the lazy
    ● function views decorators
    @protected_resource()
    def my_view(request):
    # A valid token is required to get here…
    ● generic class based views
    class ApiEndpoint(ProtectedResourceView):
    def get(self, request, *args, **kwargs):
    return HttpResponse('Hello, OAuth2!')
    

    View Slide

11. DRF ootb integration
    REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
    'oauth2_provider.ext.rest_framework.OAuth2Authentication',
    )
    }
    

    View Slide

12. Future plans - Help needed!
    OAuth1 support
    Resource and
    Authorization
    server components
    separation
    https://github.com/evonove/django-oauth-toolkit
    +1 for my own PR
    

    View Slide