Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Protect a Django REST api with Oauth2
Search
Massimiliano Pippi
April 10, 2015
Programming
0
170
Protect a Django REST api with Oauth2
Lightning talk for pycon15
Massimiliano Pippi
April 10, 2015
Tweet
Share
More Decks by Massimiliano Pippi
See All by Massimiliano Pippi
Finding the needle: a deep dive into the rewriting of Haystack
masci
0
40
Project layout patterns in Go
masci
1
480
A Python and a Gopher walk into a bar - Embedding Python in Go. (dotGo2017)
masci
0
700
A Python and a Gopher walk into a bar - Embedding Python in Go.
masci
0
200
How to port your Python software to Go without people noticing
masci
0
200
Python - Go One Way
masci
0
150
How we stopped using the mouse and started drawing molecules with our fingertips: not the usual porting story
masci
0
71
Django 1.7 on App Engine
masci
0
170
If code is poetry, then documentation is prose
masci
0
77
Other Decks in Programming
See All in Programming
[DroidKaigi 2024] Android ViewからJetpack Composeへ 〜Jetpack Compose移行のすゝめ〜 / From Android View to Jetpack Compose: A Guide to Migration
syarihu
1
630
AndroidアプリのUIバリエーションをあの手この手で確認する / Check UI variations of Android apps by various means
tkmnzm
1
170
LangChainでWebサイトの内容取得やGitHubソースコード取得
shukob
0
160
GraphQL あるいは React における自律的なデータ取得について
quramy
11
3k
REXML改善のその後
naitoh
0
190
Ruby Parser progress report 2024
yui_knk
2
230
Kotlin 2.0 and Beyond
antonarhipov
2
150
The Shape of a Service Object
inem
0
520
RAGの回答精度評価用のQAデータセットを生成AIに作らせた話
kurahara
0
250
unique パッケージから学ぶ interning と weak reference @ Asakusa.go#3
karamaru
2
810
Findy - エンジニア向け会社紹介 / Findy Letter for Engineers
findyinc
4
90k
Rubyとクリエイティブコーディングの輪の広がり / The Growing Circle of Ruby and Creative Coding
chobishiba
1
270
Featured
See All Featured
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
23
1.7k
The Illustrated Children's Guide to Kubernetes
chrisshort
47
48k
The Invisible Customer
myddelton
119
13k
StorybookのUI Testing Handbookを読んだ
zakiyama
26
5.1k
The Pragmatic Product Professional
lauravandoore
31
6.2k
Speed Design
sergeychernyshev
22
430
Typedesign – Prime Four
hannesfritz
39
2.3k
The Art of Delivering Value - GDevCon NA Keynote
reverentgeek
1
53
5 minutes of I Can Smell Your CMS
philhawksworth
202
19k
Robots, Beer and Maslow
schacon
PRO
157
8.2k
Statistics for Hackers
jakevdp
794
220k
A Tale of Four Properties
chriscoyier
155
22k
Transcript
Protect a Django REST API with OAuth2 Massimiliano Pippi @maxpippi
Introducing my friend Harold Let’s say we want to write
a timetracking web application y u not pushing? git push -f works lol
Backend recipe Django & Django REST Framework u can use
the new DRF3 generic views here wut?
Projects proliferation timetracker-backend timetracker-web timetracker-[android|ios] timetracker-desktop yep! I need an
app for my nokia 3210
How do we do access control? Third party apps want
to access our data as well! not ma problem can’t hear u
Common problems • Using user credentials inside the app is
a bad idea • The app might have full access to user account • User has to change his password to revoke the access
Multiple problems - one Solution The OAuth2 framework omg not
oauth again
Django OAuth Toolkit • Django 1.4 → 1.7 (1.8 coming
soon) • Python 2&3 • built on top of oauthlib, RFC 6749 compliant • DRF 2&3 integration https://github.com/evonove/django-oauth-toolkit
Batteries included • builtin views to register and manage OAuth2
applications • form view for user authorization lol I found what DRF stands for omg harold plz retire
Endpoints protection for the lazy • function views decorators @protected_resource()
def my_view(request): # A valid token is required to get here… • generic class based views class ApiEndpoint(ProtectedResourceView): def get(self, request, *args, **kwargs): return HttpResponse('Hello, OAuth2!')
DRF ootb integration REST_FRAMEWORK = { 'DEFAULT_AUTHENTICATION_CLASSES': ( 'oauth2_provider.ext.rest_framework.OAuth2Authentication', )
}
Future plans - Help needed! OAuth1 support Resource and Authorization
server components separation https://github.com/evonove/django-oauth-toolkit +1 for my own PR