A stateless authentication backend intended to temporarily expose protected resources.
Deploy your own, or try out https://drf-signed-auth.herokuapp.com
The motivation for this package comes from a frequent project requirement to directly download served by the API in formats like CSV or Excel within the context of a single-page-application.
Within this context, authentication cannot be achieved using HTTP Headers, as
the resource is accessed directly through a URL via an <a>
tag. Therefore, a
temporary signature passed in the query string must be used to authenticate the
request.
This package uses Django's cryptographic signing to produce a short-lived signature. It provides a view used to produce the signature and a DRF authentication backend.
Use this backend with caution and sparingly. Anyone with a copy of the signed
URL will be able to access a protected resource, so keep the expiry time
short (see settings), and ensure that the Django SECRET_KEY
setting is kept
private.
- Python 2.7 / 3.6
- Django 1.8, 1.9, 1.10, 1.11
- Django REST Framework 3.6, 3.7
pip install drf-signed-auth
Register the SignUrlView in urls.py
# urls.py
from django.conf.urls import url
from drf_signed_auth.views import SignUrlView
urlpatterns = [
...
url(r'^sign-url/$', SignUrlView.as_view(), name='sign-url'),
...
]
Use the authentication backend on the view you wish to expose.
# views.py
from drf_signed_auth.authentication import SignedURLAuthentication
from rest_framework.permissions import IsAuthenticated
from rest_framework.views import APIView
class MyCSVView(APIView):
...
authentication_classes = [SignedURLAuthentication]
permission_classes = [IsAuthenticated]
...
Obtain the signature by making a POST request to the Sign URL endpoint, and
provide the url
of the endpoint you wish to access. This can be a relative
or absolute path.
# Request
POST /sign-url HTTP/1.1
HOST your.api.host
Content-Type: application/json
{"url": "/path"}
# Response
https://your.api.host/path?sig=xxxxxxxxxxxxxxx
The returned URL will be valid for the time specified by the SIGNED_URL_TTL
.
The following settings may be configured in your project's settings.py
Setting | Description | Default |
---|---|---|
SIGNED_URL_TTL |
The time in seconds for which the signature is valid | 30 (seconds) |
SIGNED_URL_QUERY_PARAM |
The querystring variable name | sig |
SIGNED_URL_PERMISSION_CLASSES |
Permission classes on the signed URL view | [rest_framework.permissions.IsAuthenticated] |