drf-jwt (officially `djangorestframework-jwt`) provides JSON Web Token (JWT) based authentication for Django REST framework. This particular fork (version 1.19.2, last released January 2022) offers a basic implementation for token generation, refreshing, and verification. While functional, active development for this specific package is limited, with `djangorestframework-simplejwt` being the widely recommended and actively maintained alternative for modern Django/DRF projects.
pip install drf-jwtVerified import paths — ran on the pinned version, not inferred.
Configure `INSTALLED_APPS` and `REST_FRAMEWORK` settings. Add JWT-specific settings under `JWT_AUTH` for token expiration and refresh. Finally, include the `obtain_jwt_token`, `refresh_jwt_token`, and `verify_jwt_token` views in your project's `urls.py`.
For actively maintained and modern JWT authentication, consider migrating to `djangorestframework-simplejwt`.
Ensure your project's environment matches these requirements. If using newer Django/DRF, migration to `djangorestframework-simplejwt` is highly recommended as it supports current versions.
Deploy your application with HTTPS enabled. Ensure `SECURE_SSL_REDIRECT = True` and appropriate security headers are configured in production.
Implement short-lived access tokens and longer-lived refresh tokens. Consider token rotation and blacklisting for improved security. Follow best practices for client-side token storage (e.g., `HttpOnly` cookies for refresh tokens to mitigate XSS risks).