DRF Authentication: JWT with SimpleJWT & Custom Permissions

APIs consumed by mobile applications (Flutter, React Native) and modern frontend SPAs cannot rely on browser session cookies due to cross-origin limitations. JWT (JSON Web Tokens) with djangorestframework-simplejwt is the industry-standard stateless authentication solution.

1. Configuring SimpleJWT in settings.py

# Install SimpleJWT
pip install djangorestframework-simplejwt

# mywebsite/settings.py
from datetime import timedelta

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework_simplejwt.authentication.JWTAuthentication',
    )
}

SIMPLE_JWT = {
    'ACCESS_TOKEN_LIFETIME': timedelta(minutes=30),
    'REFRESH_TOKEN_LIFETIME': timedelta(days=7),
    'ROTATE_REFRESH_TOKENS': True,
    'BLACKLIST_AFTER_ROTATION': True,
    'AUTH_HEADER_TYPES': ('Bearer',),
}

2. Registering Token Endpoints in urls.py

# mywebsite/urls.py
from django.urls import path
from rest_framework_simplejwt.views import (
    TokenObtainPairView,
    TokenRefreshView,
    TokenVerifyView,
)

urlpatterns = [
    # Submit username/password -> returns access & refresh tokens
    path('api/token/', TokenObtainPairView.as_view(), name='token_obtain_pair'),
    # Submit refresh token -> returns new access token
    path('api/token/refresh/', TokenRefreshView.as_view(), name='token_refresh'),
    # Verify token validity
    path('api/token/verify/', TokenVerifyView.as_view(), name='token_verify'),
]

3. Building a Custom IsOwnerOrReadOnly Permission Class

# blog/permissions.py
from rest_framework import permissions

class IsOwnerOrReadOnly(permissions.BasePermission):
    """Custom permission to only allow owners of an object to edit or delete it."""

    def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to any request (GET, HEAD, OPTIONS)
        if request.method in permissions.SAFE_METHODS:
            return True

        # Write permissions are only allowed to the author
        return obj.author.user == request.user