Authentication (Djoser)

This page outlines the authentication system in The Wall API, which utilizes Djoser for token-based authentication, enhanced with custom OpenAPI schema extensions.

Table of Contents

1. Overview
2. Authentication Endpoints
3. Custom Djoser Integration
   3.1 Authentication Handling
   3.2 Throttling Controls
   3.3 OpenAPI Schema Documentation
   3.4 Key DRF Files

1. Overview

• Djoser is a lightweight Python library designed for Django Rest Framework (DRF), providing a modular and extensible solution for user authentication.

• It is a core dependency of the project, simplifying token-based authentication and user management. The library provides built-in views for authentication, but The Wall API only exposes a selected subset of these endpoints.

---

2. Authentication Endpoints

Action	Endpoint	Requires Authentication?
Create User	/api/v2/auth/users/	❌ No
Set Password	/api/v2/auth/users/set_password/	✅ Yes
Login (authenticate)	/api/v2/auth/token/login/	❌ No
Logout (revoke token)	/api/v2/auth/token/logout/	✅ Yes
Delete User	/api/v2/auth/users/me/{username}/	✅ Yes

💡 API Access Overview - Full API endpoints breakdown and applied throttling rates.

💡 User Management - Djoser endpoints usage guide.

💡 Detailed OpenAPI Documentation - Comprehensive information on each authentication endpoint and its parameters.

---

3. Custom Djoser Integration

Djoser authentication in The Wall API is extended using custom Django Rest Framework (DRF) views. These modifications ensure secure authentication handling, request throttling, and detailed OpenAPI documentation.

3.1 Authentication Handling

• Authentication is enforced using Django’s authentication_classes, ensuring requests comply with the configured authentication backends.
• This guarantees secure token-based authentication for all users.

3.2 Throttling Controls

• Throttling is applied to prevent excessive authentication requests.
• The throttle scope for user-related actions is User management, and for unauthenticated users - Unauthenticated.

💡 For more details on throttling implementation, refer to the API Throttling page.

3.3 OpenAPI Schema Documentation

• Authentication endpoints are fully documented using DRF Spectacular's schema extension, providing structured and developer-friendly API documentation.

💡 For more details on OpenAPI schema generation, see the DRF Spectacular page.

3.4 Key DRF Files

The following files handle authentication logic:

• the_wall_api/utils/open_api_schema_utils/djoser_utils.py – Extends Djoser views with custom OpenAPI schema definitions.

• config/urls.py – Maps authentication-related endpoints.

• the_wall_api/utils/api_utils.py – Handles authentication endpoint registration as part of the centralized API configuration.

• config/settings.py – Defines authentication and permission settings.

  • Global authentication settings:

    REST_FRAMEWORK = {
        'DEFAULT_AUTHENTICATION_CLASSES': [
            'rest_framework.authentication.TokenAuthentication',
        ],
        'DEFAULT_PERMISSION_CLASSES': [
            'rest_framework.permissions.IsAuthenticated',
        ],
    }

    💡 These settings enforce token-based authentication and restrict access to authenticated users for all existing views, unless explicitly overridden in the view configuration.
    
    

  • Djoser is configured for username-based authentication, requiring users to authenticate with their username instead of an email:

    DJOSER = {
        'USER_ID_FIELD': 'username',
    }

    
    

---

Next:   File Management Endpoints
Back to: API URL Routing

Return to Top
DTS Index
Home Page

---