Hello everyone.
And welcome back.
In this lesson you will learn how to use the Django Rice staff package in order to expose the registration
and authentication and POINTS FOR YOUR REST API is thanks to these endpoints clients such as Android
and our U.S. applications will be able to easily and independently communicate with all the services
provided by your web apps backend.
The arrest to make learning easier.
This lecture will be split in two parts time to code.
Let's get started talking about authentication.
The best place to start is Django as frameworks documentation.
As you can see the default authentication schemes may be set globally once again using the default authentication
classes within the last framework and dictionary in the setting stood by file as you can see by default.
We've got basic authentication and A session authentication.
And in this lesson we're going to add token authentication to the default authentication glasses that
are available.
We are clearly now going to make a lot of examples and talk a lot about talking authentication.
But as you can see here from API reference you can always find further details.
In case you feeling like you might need to.
To implement token authentication.
We can now copy the rest framework dictionary going to visit your code and as you can see here I have
opened the settings stood by file and therefore I can just paste the dictionary.
However we do not need basic authentication.
Therefore we can just delete it and instead we can now add token authentication.
We are keeping it in session authentication as well because this way we can still authenticate using
the browser API because the browser API is clearly a web client and as we said the best authentication
scheme to use with browser based clients is session authentication and it will then ring to see how
to use token authentication in great detail by creating a simple client ourselves using the request
module.
And so because we want to use the token authentication scheme we need to go ahead and we've seen that
installed obsolete still.
We need to add risk framework dot of token and that's because we said that the talk is that we are using
are going to be saved in the database and therefore we now need to apply the appropriate migration.
So I'm going to quit the development server and now Python managed not by migrate and yada yada auth
token migrations are applied and we can now go ahead and check the admin interface to find out that
the token app has been added there as well.
So look I lost slash admin going to log logging
and then it is off to can that we can use to actually add new tokens.
But of course this is all going to be managed automatically by Django framework.
What we need to do now instead is to go ahead and install Django rest of which as we said is a very
useful package that provides us registration and authentication and points for our arrest clients so
people can start Django rest off.
Like so and we can also install the requests module which we're going to need to create our clients.
So people start requests perfect and we can also now update our requirements that GST file so people
freeze requirements that these the perfect and we can now watch this one as well at least on installed
absent so simply rest off.
Let's now go to get you arrested by five of the project because of course we need to include dead points
that are provided by the package.
So first of all include Dan
EPA.
The rest also include rest was not your address.
And considering that we're here we can also include January's frameworks you had us file to logging
via browser API.
So API off and yet clearly this is going to be rest framework no threat else.
Now just to make everything more comprehensible.
Let's have a look at the login view class that is part of the rest of the package.
So from rest of that viewers import logging view.
So let's go to the finisher.
We see that it extends generic API view.
Check the credentials return and the rest token.
If the credentials are valid and authenticated it accepts user name and password the parameters of your
post.
And as we said clearly it returns the key that we need to authenticate.
So let's close these files for now and let's create some clients instead of using the request module.
And so we are going to create a new file and we can just call the two talking North test one token of
just one dot pi.
First of all we need to import the requests module then yeah we can define a client function.
And considering that we're going to need to perform at in a virus that first of all as we said we are
going to need our credentials.
So that shows equals a dictionary with user name.
In this case admin and password which is very complicated in this example.
Again please remember to use strong and effective passwords in production.
And with the credentials we can now make it post to request to the login and bind.
So response equals requests to post.
And first of all the endpoint which is h to be Andrew in 27 that's 0 0 that one forty eight thousand
which is clearly the address where the development server is running and then the API rest of logging.
Of course we also need to pass the data so our credentials data equals credentials.
So let's now see what the API response as we first saw first of all let's create status code.
So that was code equals response dot status code then response data equals and we see that indentation
is slightly misaligned.
So and So response data equals a response not Jason.
And we can then print response data.
Now if name equals mean just call our client.
So first of all let's now run our development server
and we're also going to need a second terminal to actually run our script.
So I'm going to move inside the client folder.
We see that we actually need to add another four words less by the end of the endpoint.
And now we have everything up running.
We can see what happens when executing our script.
So Python took enough test 1 and awesome.
Everything is expected.
We get the status code 200 which means all.
Okay and we get our token from syndicating apply it perfect.
From now on.
If we wanted to we could use this specific token to authenticate all the requests to work the api in
order to access all the Web services provided by your web app including those required authentication
of course.
And this token it's been saved to the database as well so that the server can actually compare it to
the one that we are going to send with each and every request in order of course to make all the system
much more secure.
Let's actually check the site administration talks and editors.
And if you click on it you see that is associated with the same user whose credentials we've used of
course to make the request in the first place.
So let's test our newly acquired talking right away.
I'm going to create a your class.
So first of all use that by file and this new class is going to provide the least with all the profiles
in our database only two authenticated users.
So first of all from trademark import generics and then from risk framework dot permissions import is
what's indicated then from profiles the models import profile and from profiles to the API dot lasers
import profile sterilizer.
Now class profile listed which is going to extend generics not list API view.
We've where he said it was profile dot objects dot all see analyzer plus equals profile sterilizer.
And permission classes equals is authenticated.
Let's not create the appropriated point for the class.
So you add else that's by.
And so from Django with your rails import path from profiles dot API dot views import profile.
And then your all partners equals it's always at least.
And here path something simple like profiles and then we're going to call profile list dot s view with
name equals profile lists and then of course we need to include this file within that main you arrested
by PHI so you're path API include profiles dot API dot your else.
And so let's now go back to that took an old test to one file and let's try to make an integrated request
first towards our profile list and points I'm going to comment out credentials and response let's not
make a get request.
So response equals requests does get and the endpoint is this one API is less profiles.
So let's now restart our development server like so that we can move back to the second terminal.
Yeah listen I'll try to make a get request to the same endpoint without using dot indication token of
course to see we get four or three what indication credentials we have not provided the request is rejected
of course because we need to authenticate ourself in order to access the profiles least up and we can't
do so by sending the indication to token in the authorization and then with every request and the request
module makes the process really easy so I'm just going to define a variable talking H token Heather
there's going to be a string but in front of the token itself we also need to define that token words
remember this because this is how you define appropriate authorization either using a token in January's
framework and then here we can define others equals authorization token each and we can now send the
headers to get request and we can just do this like so and so now let's try to make the same request
once again like so awesome this time the request as you can see is successful we get status code 200.
Okay.
And the least with the Jason File of each profile in our database and at the moment we only have to
profile instances therefore we only see two.
But that's more than enough to be satisfied for now and to really complete this lesser.
Let's now check the same endpoint but this time using the browser API to remember and prove that we're
actually using two different authentication schemes.
So I'm just going to paste the endpoint like so and as expected it is at least we have profiles because
we don't indicated indicated is that mean looking out making another request.
Of course we get data authentication credentials were provided.
Perfect.
Okay.
So that was it for this lesson.
See you in the next election about Django rest of which is going to be really exciting because we are
going to set up a registration and point.