Registry / auth-security / django-graphql-jwt

django-graphql-jwt

JSON →
library0.4.0pypypiunverified

django-graphql-jwt is a Python library that provides JSON Web Token (JWT) authentication for Django GraphQL applications. It integrates seamlessly with graphene-django and Django's authentication system, offering mutations for obtaining, refreshing, and verifying tokens, as well as decorators and mixins for protecting GraphQL views and fields. It is currently at version 0.4.0 and typically releases updates as needed, often tied to major versions of Django, Graphene-Django, or PyJWT.

pip install django-graphql-jwt
INSTALL
IMPORT
SIG · DJANGO-GRAPHQL-JWT
D
django-graphql-jwt
auth-securitypythonv0.4.0
Install
5.5s avg
Import
Disk
75MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v0.4.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.910 runs
installs and imports cleanly · install 0.0s · import 0.000s · 75.1MB
glibc
py 3.103.910 runs
installs and imports cleanly · install 5.5s · import 0.000s · 76MB
75MB installed
● package 75MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

login_required
from graphql_jwt.decorators import login_required
from graphql_jwt.decorators import login_required
JWTAuthMiddleware
from graphql_jwt.middleware import JWTAuthMiddleware
ObtainJSONWebToken
from graphql_jwt.views import ObtainJSONWebToken

This quickstart demonstrates how to define a basic `django-graphql-jwt` schema with `ObtainJSONWebToken`, `VerifyToken`, and `RefreshToken` mutations. It includes a minimal, self-contained Django environment setup to make the code runnable, creating a test user and then executing sample GraphQL mutations to obtain and verify a token. For a full Django project, you would integrate `AUTHENTICATION_BACKENDS` and `MIDDLEWARE` into your project's `settings.py` and expose the schema via `graphene_django.views.GraphQLView`.

import graphene import graphql_jwt from django.conf import settings from django.core.management import call_command from django.contrib.auth import get_user_model # Minimal Django settings for a runnable example if not settings.configured: settings.configure( SECRET_KEY='a-very-secret-key-for-testing', DEBUG=True, ALLOWED_HOSTS=['*'], INSTALLED_APPS=[ 'django.contrib.admin', 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.messages', 'django.contrib.staticfiles', 'graphene_django', 'graphql_jwt', ], AUTHENTICATION_BACKENDS=[ 'graphql_jwt.backends.JSONWebTokenBackend', 'django.contrib.auth.backends.ModelBackend', ], MIDDLEWARE=[ 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'graphql_jwt.middleware.JSONWebTokenMiddleware', ], ROOT_URLCONF=__name__, # Simplistic for example TEMPLATES=[{ # Required for admin to work minimally 'BACKEND': 'django.template.backends.django.DjangoTemplates', 'DIRS': [], 'APP_DIRS': True, 'OPTIONS': {'context_processors': [ 'django.template.context_processors.debug', 'django.template.context_processors.request', 'django.contrib.auth.context_processors.auth', 'django.contrib.messages.context_processors.messages', ]}}, ], DATABASES={'default': {'ENGINE': 'django.db.backends.sqlite3', 'NAME': ':memory:'}}, GRAPHQL_JWT={ # Example custom settings 'JWT_VERIFY_EXPIRATION': True, 'JWT_EXPIRATION_DELTA': 'datetime.timedelta(minutes=5)', 'JWT_REFRESH_EXPIRATION_DELTA': 'datetime.timedelta(days=7)', } ) # Apply migrations for auth models call_command('migrate', verbosity=0, interactive=False) # Create a dummy user for the example User = get_user_model() try: User.objects.get(username='testuser') except User.DoesNotExist: user = User.objects.create_user(username='testuser', email='test@example.com', password='password123') # Define your GraphQL schema class Query(graphene.ObjectType): hello = graphene.String(name=graphene.String(default_value="World")) def resolve_hello(self, info, name): return f"Hello {name}!" # Custom mutation for obtaining token with user info class ObtainJSONWebToken(graphql_jwt.JSONWebTokenMutation): user = graphene.Field(User.__class__) @classmethod def resolve_mutant(cls, root, info, **kwargs): return cls(user=info.context.user) # Custom mutation for refreshing token with user info class RefreshToken(graphql_jwt.RefreshTokenMutation): user = graphene.Field(User.__class__) @classmethod def resolve_mutant(cls, root, info, **kwargs): return cls(user=info.context.user) # Custom mutation for verifying token with user info class VerifyToken(graphql_jwt.VerifyTokenMutation): user = graphene.Field(User.__class__) @classmethod def resolve_mutant(cls, root, info, **kwargs): return cls(user=info.context.user) class Mutation(graphene.ObjectType): token_auth = ObtainJSONWebToken.Field() verify_token = VerifyToken.Field() refresh_token = RefreshToken.Field() schema = graphene.Schema(query=Query, mutation=Mutation) # Example usage (run a mutation against the schema) if __name__ == "__main__": print("\n--- Attempting to obtain token ---") obtain_token_query = """ mutation ObtainToken { tokenAuth(username: "testuser", password: "password123") { token user { username email } } } """ result = schema.execute(obtain_token_query) if result.errors: print("Errors:", result.errors) else: print("Data:", result.data) token = result.data['tokenAuth']['token'] print("\n--- Attempting to verify token ---") verify_token_query = f""" mutation VerifyToken {{ verifyToken(token: "{token}") {{ payload user {{ username }} }} }} """ result_verify = schema.execute(verify_token_query) if result_verify.errors: print("Errors:", result_verify.errors) else: print("Data:", result_verify.data)
Debug
Known issues
breakingAs of version 0.4.0, JWT token verification errors are now correctly propagated as `graphql_jwt.exceptions.JSONWebTokenError` exceptions, rather than being silently suppressed or returning `None` in some contexts. This changes error handling behavior.
fix
Update your GraphQL clients or resolver logic to properly catch and handle `JSONWebTokenError` exceptions, providing more informative error messages.
affects: 0.4.0+
gotchaFor `django-graphql-jwt` to function correctly, `graphql_jwt.backends.JSONWebTokenBackend` MUST be included in your Django project's `AUTHENTICATION_BACKENDS` setting. Without it, Django's authentication system will not recognize the JWT backend.
fix
Add `'graphql_jwt.backends.JSONWebTokenBackend'` to your `AUTHENTICATION_BACKENDS` list in `settings.py`. Ensure it's before `'django.contrib.auth.backends.ModelBackend'` if you want JWT to be the primary authentication method.
affects: All versions
gotchaTo ensure that the authenticated user information from a JWT is available in `info.context.user` within your GraphQL resolvers, you must include `graphql_jwt.middleware.JSONWebTokenMiddleware` in your Django project's `MIDDLEWARE` setting.
fix
Add `'graphql_jwt.middleware.JSONWebTokenMiddleware'` to your `MIDDLEWARE` list in `settings.py`, preferably after `django.contrib.auth.middleware.AuthenticationMiddleware`.
affects: All versions
deprecatedThe `refresh_token` field on the `tokenAuth` mutation is deprecated as of version 0.4.0. Users should migrate to using the standalone `RefreshTokenMutation` for token refreshing.
fix
Update your GraphQL clients and schema to use the dedicated `refreshToken` mutation (e.g., `refresh_token = RefreshToken.Field()`) instead of relying on the `tokenAuth` mutation for token refreshing.
affects: 0.4.0+
Upgrade
Version history
0.4.0latest on PyPI · released Aug 4, 2023
Audit
Dependencies
DjangorequiredCore web framework dependency.
PyJWTrequiredHandles JWT encoding and decoding.
graphql-corerequiredCore GraphQL library for Python.
graphene-djangorequiredDjango integration for Graphene GraphQL.
Agent activity
32 hits · last 30 days
node
30
OpenAI (training)
1
Resources
django-graphql-jwt — pip install django-graphql-jwt · libregistry