Registry / auth-security / drf-jwt

drf-jwt

JSON →
library1.19.2pypypiunverified

drf-jwt (officially `djangorestframework-jwt`) provides JSON Web Token (JWT) based authentication for Django REST framework. This particular fork (version 1.19.2, last released January 2022) offers a basic implementation for token generation, refreshing, and verification. While functional, active development for this specific package is limited, with `djangorestframework-simplejwt` being the widely recommended and actively maintained alternative for modern Django/DRF projects.

pip install drf-jwt
INSTALL
IMPORT
SIG · DRF-JWT
D
drf-jwt
auth-securitypythonv1.19.2
Install
4.5s avg
Import
Disk
87MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v1.19.2 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 87.4MB
glibc
py 3.103.920 runs
installs and imports cleanly · install 4.5s · import 0.000s · 88MB
87MB installed
● package 87MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

JSONWebTokenAuthentication
from rest_framework_jwt.authentication import JSONWebTokenAuthentication
from rest_framework_jwt.authentication import JSONWebTokenAuthentication

Configure `INSTALLED_APPS` and `REST_FRAMEWORK` settings. Add JWT-specific settings under `JWT_AUTH` for token expiration and refresh. Finally, include the `obtain_jwt_token`, `refresh_jwt_token`, and `verify_jwt_token` views in your project's `urls.py`.

import os from datetime import datetime, timedelta # settings.py # Add 'rest_framework' and 'rest_framework_jwt' to INSTALLED_APPS INSTALLED_APPS = [ # ... 'rest_framework', 'rest_framework_jwt', # ... ] REST_FRAMEWORK = { 'DEFAULT_AUTHENTICATION_CLASSES': ( 'rest_framework_jwt.authentication.JSONWebTokenAuthentication', 'rest_framework.authentication.SessionAuthentication', 'rest_framework.authentication.BasicAuthentication', ), 'DEFAULT_PERMISSION_CLASSES': ( 'rest_framework.permissions.IsAuthenticated', ), } JWT_AUTH = { 'JWT_EXPIRATION_DELTA': timedelta(seconds=int(os.environ.get('JWT_EXPIRATION_SECONDS', 3600))), 'JWT_ALLOW_REFRESH': True, 'JWT_REFRESH_EXPIRATION_DELTA': timedelta(days=int(os.environ.get('JWT_REFRESH_DAYS', 7))), 'JWT_RESPONSE_PAYLOAD_HANDLER': 'your_app.utils.jwt_response_payload_handler', # 'JWT_SECRET_KEY': os.environ.get('DJANGO_SECRET_KEY', 'your_secret_key'), # Uses Django's SECRET_KEY by default } # urls.py from django.urls import path from rest_framework_jwt.views import obtain_jwt_token, refresh_jwt_token, verify_jwt_token urlpatterns = [ path('api-token-auth/', obtain_jwt_token), path('api-token-refresh/', refresh_jwt_token), path('api-token-verify/', verify_jwt_token), # ... other app URLs ] # Example of a custom payload handler in your_app/utils.py # def jwt_response_payload_handler(token, user=None, request=None): # return { # 'token': token, # 'user': user.username, # 'id': user.id # }
Debug
Known issues
deprecatedThe original `jpadilla/django-rest-framework-jwt` project is officially unmaintained. This `Styria-Digital` fork, while available on PyPI, has not had a release since January 2022, indicating very limited ongoing maintenance.
fix
For actively maintained and modern JWT authentication, consider migrating to `djangorestframework-simplejwt`.
affects: <1.19.2
gotchaThe package requires specific versions of Python, Django, and Django REST Framework. Version 1.19.2 explicitly states Python 2.7, 3.4+, Django 1.11+, and DRF 3.7+.
fix
Ensure your project's environment matches these requirements. If using newer Django/DRF, migration to `djangorestframework-simplejwt` is highly recommended as it supports current versions.
affects: All versions
gotchaSecurity Warning: Always use SSL/TLS (HTTPS) for your API endpoints when using JWT. The token itself only verifies user identity; the request parameters are not signed and can be tampered with in transit if not encrypted.
fix
Deploy your application with HTTPS enabled. Ensure `SECURE_SSL_REDIRECT = True` and appropriate security headers are configured in production.
affects: All versions
gotchaToken storage on the client-side (e.g., `localStorage` for access tokens, `HttpOnly` cookies for refresh tokens) and proper handling of token expiration, rotation, and blacklisting are crucial security considerations often overlooked.
fix
Implement short-lived access tokens and longer-lived refresh tokens. Consider token rotation and blacklisting for improved security. Follow best practices for client-side token storage (e.g., `HttpOnly` cookies for refresh tokens to mitigate XSS risks).
affects: All versions
Upgrade
Version history
1.19.2latest on PyPI · released Jan 9, 2022
Audit
Dependencies
DjangorequiredRequired for any Django project.
djangorestframeworkrequiredCore dependency for Django REST Framework integration.
PyJWTrequiredUsed for JWT encoding and decoding. Implicitly installed.
Agent activity
29 hits · last 30 days
node
26
OpenAI (training)
1
Resources
drf-jwt — pip install drf-jwt · libregistry