使用Django Rest Framework登录

Question

I have a website in Django and I'm developing an Android app. In one activity I have to login the user. I have installed the Django Rest Framework but I'm afraid that is insecure to send the username and password. What's the best way to do a login using Rest Framework?

Answer 1

You may use basic authentication, by providing an user name and password, but it has to be done over https. Otherwise, there are different other authentication mechanism you may use. Have a look here . The appropriate one for a mobile application would probably be token authentication.

Answer 2

One of the most popular ways to authenticate with REST APIs is through tokens. What this essentially means is to set up an API endpoint that receives the "username" and "password" and responds with a token. And then each request make to the API should go with this token as a header or a param, and get resolved and validated before running the function behind the API. This way you username and password will only be send once. Of course, even with this, it is recommended to use HTTPS.

A good way to do this is to use djangorestframework-jwt ( http://getblimp.github.io/django-rest-framework-jwt/ ). This is an app providing JSON Web Token functionality for Django Rest Framework APIs.