使用DRF-JWT检索Postman中的列表测试，确定DRF中的IsAuthenticated

Question

So I'm using DRF JWT for my authentication. User submits credentials, and if valid, responds with a JWT that is stored in sessionStorage . Any time the user navigates the protected routes, the JWT /api/auth/refresh to refresh the token if it is still valid.

Anyway, moving on from authentication and onto protected routes where data is retrieved based on if the user is IsAuthenticated according to DRF. The problem is I am having difficulty figuring out how to determine IsAuthenticated in DRF without having the user supply credentials again. I should mention right now I am testing with Postman.

API URL:

/api/help/questions

I have the view as:

class GetQuestionsAPIView(ListAPIView):
    queryset = Help.objects.all()
    serializer_class = GetQuestionsSerializer
    permission_classes = [IsAuthenticated,]

The serializer is:

class GetQuestionsSerializer(ModelSerializer):

    class Meta:
        model = Help
        fields = '__all__'

    def validate(self, data):
        return data

I have a valid token from /api/auth/signin/ . I'm trying to pass it on to the /api/help/questions/ route to retrieve the list of questions.

GET /api/help/questions/ doesn't work because it wants credentials. Authentication credentials were not provided.

GET /api/help/questions/ with Content-type: application/json and 'Authorization and the token in the header also says Authentication credentials were not provided.`

Thought maybe it should be POST since I submitting credentials and expecting the questions as the server response if authentication is valid, but pretty much the same results.

I'm obviously not the most knowledgeable on this subject, so any help would be appreciated.

Answer 1

Did you put your token into Authorization header? So after you login, you get a token and you should put it inside the headers on the request for your protected url like this:

Authorization: JWT <your_token>

Here's a sample using curl :

curl -H "Authorization: JWT <your_token>" http://localhost:8000/protected-url/