How to log in? Django TastyPie with ApiKeyAuthentication Actual Authentication Procedure

Question

I have an Adobe Air mobile app that communicates with Django through TastyPie. To use the app, people must first register. Therefore, they must provide their email and password. Subsequently, they will be able to "enter." I thought it would be a better idea that after entering a successful combination of username and password, the api-key will be sent back to the mobile application where it will be cached, so the user "logged in".

Please tell me if you think that there is a better way to register and log in.

Inside Django, I have a UserRessource class that I use to register new users when sending data via POST:

class UserResource(ModelResource): class Meta: allowed_methods = ['get', 'post'] queryset = User.objects.all() resource_name = 'auth' authentication = Authentication() authorization = Authorization() fields = ['username', 'email'] def obj_create(self, bundle, request=None, **kwargs): username, email, password = bundle.data['username'], bundle.data['password'], bundle.data['password'], try: bundle.obj = User.objects.create_user(username, email, password) except IntegrityError: raise BadRequest('That username already exists') return bundle 

It works very well.

But now I'm struggling with the actual login process. In my opinion, it would be better to send the username and password via GET (and https) to this ressource, and if they are correct, return the api key for the users. But is it possible? And is that clean? Typically, TastyPie will show all users currently in the database if you send a GET request to this resource. But I do not need this data, so I can somehow rewrite it. I already checked http://django-tastypie.readthedocs.org/en/v0.9.9/resources.html , but I can't get it to work. Is it even possible to overwrite this behavior?

So, the actual questions. What is the best way to “log in” to a user using ApiKeyAuthentication? And Is my approach correct and clean or do you have a better method? and do you have any examples for this case?

Thanks in advance!

Answer 1

I use BasicAuth, so it may be slightly different. But my solution is basically an empty resource requiring authentication. If authentication is successful, the service returns a 200 response code and an authenticated user, I redefine obj_get_list and populate the authenticated user. If the credentials are incorrect, the service returns a 401 response code.

  class LoginResource(ModelResource): class Meta: allowed_methods = ['get'] resource_name = 'login' include_resource_uri = False object_class = User authentication = BasicAuthentication() authorization = DjangoAuthorization() def obj_get_list(self, bundle, **kwargs): return [bundle.request.user] 

Answer 2

Well, I will try to explain my point of view on the topic:

First, the UserResource example on the tastypie page has one important problem for me: User objects should not be presented to a single user at any time, they should be able to see that they are their own “profiles” or something else, but they never view or see others. Of course, this can also be done using UserResource by clearing the main “list view” of this resource and applying APIKeyAuth to individual profiles, but I still don’t like the idea of ​​UserResource.

The second in the form, when you are developing an API (for example, using tastypie), the APIKey is the actual "password", so what should be sent on request is not the username and password, but the username and APIKey, which can be obtained in other ways (usually email or some kind of website based user interface). Than it is recommended to send them through the authorization header, and not in the GET parameters.

Thirdly, when we talk about the API, there is no such thing as logging in - at least not in the RESTFULL API - it is in some sense contactless, so you are actually sending an authorization header with each request. Regarding the yes question, you can overwrite the data. Take a look at the hydrate / dehydration cycle in Tastypie docs to understand how it displays content, and if you have another question, ask it.