JSON Web Token Authentication and RefreshToken . Django rest framework project tutorial[7]

all right guys welcome back to this tutorial so in the previous set of videos we have been able to register a user and activate them so if you haven't checked those ones out please go check them out just so they can lead to this so if you haven't subscribed to the channel please subscribe and now if you go to our views.py we need to set up an endpoint to log in a user so i'm going to create a class best view here so class login api view so this is going to be inheriting from generics to generic api view the user is going to be sending a post request so def post server and request you already know so down here we need to get what the user is sending and then send it to the serializer so here we can do cellularizer which we are going to set up serializer this is going to be equal to self.serializer class and then we give it the data so we can do data equals use test set up the user so user is going to be request data which actually is very shorthand that we can literally bring it in here the way it is all right so now that we pass this one in we need to run the validate method and the say eraser which you can do with serializer dot is valid and then we raise exceptions once there is the problems arrays exceptions exceptions equals true okay so raise exception equals true all right so we need to define our serializer so here you can have three riser class this is going to be equal to login serializer all right so let's bring that in so let's import it from our serializers and then going to the serializers.py we're going to set up a class so it's going to be class login serializer we import from serializers to module serializer and down here we can define our custom our fields for the for the serializer itself so we're going to need the email then the password yeah so here we can find email because it's a realizer this is going to be email field so here now we can define our constraints so of course it has to be a varied email but then we want to define like max length because 255 mean length just so we can get these custom messages when we're making requests without doing a lot of validation so many links can be like form but really doesn't matter as long as an email field it will still be validated against being an email field okay so another thing i want to have basically is the password so password it's going to be serializers dot chart field max length 68 mean length it is gonna be six all right so once we have this we need to make sure this is correctly written correctly so once we have this now we need to define our validate so here they've varied it so this is where actually we do the login the authenticate user so in the validate we can get the email from email equals address then we can do dot get email and then let's have a fallback for empty do something for the password so once we have this now we want to to authenticate this user so for us to be able to educate the user we're going to import some utilities so from django [Music] contrib import auth all right so let's import auth now here we want to log in this user so you can do authent actually on the user equals auth authenticate so it takes in a request and then the credentials so the request can be now we can pass an email because email and then password equals password all right so once the user exists it's going to be bringing us the once the user exists we're going to bring us a user instance so here we can actually check so if not user so that will be when a user is not there then we can tell them that they have another account so we can do raise say that raises failed oh so for us we need to import actually authentication failed so let's bring it in here so from rest framework with exceptions import authentication field all right so now down here you can raise authentication field and then we put we give them the detail so what you're gonna do is you're gonna say something like invalid credentials try again all right so once we have this we we now want to validate that the user's email is verified and they also are active okay so here we can do if user dot oh so we can do something like if not user dots is active then we can say something like account inactive organic account disabled contact admin so let's check for the verif for the one that's not verified so we can now check for if account if not account is verified then we can say email is not verified all right so basically this will check all those cases and now if we have a user we need to to return the user details so here we can actually have return so if any of this fails it will run up to that point and then once it passes we can return some data so we're going to return the email which will be so the email is going to be user email the username can be user username then the next thing will be the so since there are going to be two tokens i'm going to actually use the keyword tokens so this is going to be so if you come back to our model here we actually wrote a tokens method but then we didn't quite complete it so let's do that so basically the error of this method should be able to give us the two tokens for this specific user so let's import some utilities here so from rest framework load simple jwt actually should be rest framework underscore simple jwt simple jwt tokens input refresh token right so once you import this now here in our tokens method create a variable called tokens so this is going to be equal to refresh token then we say those four user for underscore user and then the user we want will be the current instance so we pass self that's gonna give us the two tokens so we want to return two things one is gonna be the refresh and then the access oh it should be inside and then the access so when i user logs in we send them an access token and they refresh token when they are token expires then we can refresh it using the refresh token without like logging out a user all right so here now this is going to be tokens dot access underscore token so this is an instance of an access token i'm going to convert it into a string so i'm going to do the same thing up here be only the refresh token all right so oh so actually let me rename this to refresh token because this is what contains the two so keep that keep that then make sure you substitute it for this so now you see we have this method called tokens so this should be able to return for us when we call it it should be able to return for us these two for this user awesome so in the serializer going back down here now we can do and then we can do user dot token so let's see so let's see so once we set up this i believe we can set up a url here so i'm going to copy this this is going to go to login and then we need to import our login api view make sure we replace it here okay so if we look at our views dot py again you'll notice that here we send the data based on your eraser it does the authentication and all that stuff but you're not actually sending back the response which you should do here okay so first we will send back the response so if this is valid actually you can return response and now we'll be sending in the data that the user sends us so the data and then you can now pass a status so this can be 200 status dot http 200 okay all right so this should do let's go ahead and test this out and see where we are so going back to our our api documentation if i reload here also we have an issue so let's see so let's look at our okay okay okay so we need to define a method yeah so we didn't set up the meta so in the serializers.py here since we imported from modus serializer we need to actually set up which model it is that we want so let's set up the class meter so we define the model automotive so model will be user and then the fields so fields this one is going to be a list and of course we want the email we want the password we want the username too let's see username and then we're going to want the tokens i believe and by the way so since we have these fields here we can actually define them here instead so let me actually bring these two in so this will be username this will be charging so i want to actually provide but then here i don't want the user to provide a username so what you can do is actually make this one so read only so you can do read only equals true so same thing for the tokens so writing i'm going to have another one called tokens this is going to be read only true and we don't need these although we can have them all right so once we have this we can actually get rid of the of these fields but i'm going to have them in there just to have them so i'm going but i'm going to leave them in there for now so if you come back here and reload you can see that the error is gone and we have our login added and it takes a post request when we click on it we can see that what is required here will be the the email and then the password and these are not required so when we go to try it out you can see that we got we only can supply an email and a password because here we specify like read-only true but let me show you something if i remove this here so the read-only away and go back to the login look at what happens so the username becomes actually required and that's not what you want so let me take it back save so once we come back here and then go to try it out so let's say we want to log in with this one click login so there's an issue so let's see oh so let's see what's happening so we're doing object okay so let's see here in our valley date if we do a pdb here which will help us to know what's going on so if we come back and now try to make the same request we should be paused in the debugger so now we can try to inspect user so if we do user we actually don't have a user meaning that this user doesn't exist so meaning we need to move this one up a bit so cut this one bring it here so let's try again let's have a backup click execute and now you can see inverted credentials and the 401 so it was about how we arrange this so let's now use the user that we already know we have so in the login i'm going to use mine gmail.com i believe my password was this name so when i click execute also there is an issue user has no attribute token so let's take a look we are doing user the token here in the modules this should be tokens okay so let's change that one oh it's realizes you can do tokens yeah so make sure you have tokens tokens here so let's try again click execute we also got key error expected field password maybe named incorrectly yes so we are sending a password okay so it's saying the serializer field might be named incorrectly so let's take a look at our password is the password is chatfield yeah so let's actually make this one right only just so we don't send it back to the user so write underscore only equals true all right so we have the mean length the max length we're adding it to our fields good okay let's try again and see what we have so submit and now you can see we are able to login we get our email back our username back and our tokens so you can see the tokens we have a refresh token and then an access token which is really good which is what we want if you enjoyed that if you enjoyed the video give it a thumbs up don't forget subscribe and i'll see you in the next one where we start doing some crud for our expenses

Channel: Cryce Truly

Views: 21,335

Keywords: django, djangorestframework, jwt, jsonwebtoken, djangologin

Id: M61KIo4DAqs

Length: 16min 30sec (990 seconds)

Published: Fri Jun 19 2020