基于Django App的API身份验证

Question

I currently have a Django web app, and am now creating an iOS app that needs to hook into the same database. So, I am creating an python API from my Django app. I don't know how to handle authentication from the iOS app to this Python API...? I want to just put Django's @login_required decorator on each of my API views (as I do for the web app part) but am not sure how to do that since the iOS client isn't sending over a User object. What should I do?

I have tried making my own decorator that looks for a username and password in the client's request, but I think that's probably very dumb on my part as I don't now how to keep the username/password secret and that username/password data is then visible in the URL. Any ideas/help would be greatly appreciated!

Answer 1

There is nothing wrong or hacky with rolling your own API views and using a basic authentication decorator, but it might be worth investing a little bit of time (perhaps 2-3 hours of tinkering) to learn Django REST Framework.

Django REST Framework is one of the better Python packages in existence (right up there with Requests) and has a huge community, so if you get stuck, StackOverflow will be by your side. It offers authentication (ie, prove who you are / login) and authorization (ie, specific access permission controls). But, I highly recommend doing the full tutorial .