jazzband/djangorestframework-simplejwt
Djangorestframework Simplejwt
This is a JSON Web Token authentication package for the Django REST Framework that manages stateless user identities. It serves as an authentication provider and token manager used to issue and validate signed tokens to maintain user sessions across multiple requests.
The project implements a dual-token lifecycle, issuing short-lived access tokens and long-lived refresh tokens to balance security with session persistence. It features token rotation to prevent replay attacks and a blacklisting system to invalidate compromised credentials. Additionally, it supports sliding-window expiration to automatically extend active sessions and allows for custom identity claims to embed user metadata directly into token payloads.
The system provides comprehensive capabilities for token signing using both symmetric and asymmetric algorithms, as well as cryptographic validation to verify identities without database lookups. It also includes integration for OpenAPI security schemes to document token-based authentication requirements and tools for database cleanup of expired tokens.
Features
- REST Framework Plugins - Provides a specialized JWT authentication extension designed specifically for the Django REST Framework.
- Request Token Validators - Verifies the identity of users by validating tokens sent in requests to secured API endpoints.
- Access and Refresh Token Issuances - Implements a dual-token system issuing short-lived access tokens and long-lived refresh tokens.
- Refresh Token Rotation - Rotates refresh tokens upon each use to detect and prevent replay attacks from stolen tokens.
- Token Blacklisting - Invalidates specific tokens before their natural expiration to prevent unauthorized access.
- JWT Session Management - Handles the lifecycle of short-lived access tokens and long-lived refresh tokens to balance security and convenience.
- Stateless Verifications - Implements identity verification using cryptographically signed tokens without requiring server-side state or database lookups.
- Identity Token Services - Validates cryptographically signed tokens to manage stateless user identities.
- Token Lifecycle Management - Manages the full token lifecycle, including issuance, refreshing, rotation, and sliding-window expiration.
- JWT Token Validators - Provides services to verify the authenticity and expiration of JSON Web Tokens without exposing signing keys.
- Token Blacklists - Tracks invalidated or rotated tokens in a database to prevent the reuse of compromised credentials.
- Session Token Refreshers - Generates new access tokens using valid refresh or sliding tokens to extend sessions.
- JWT Authentications - Implements identity verification by validating signed JSON Web Tokens attached to REST API requests.
- Session Token Issuance - Exchanges user credentials for access and refresh token pairs to establish secure sessions.
- Stateless Token Validation - Verifies user identity cryptographically using digital signatures without requiring database queries.
- Token Rotation and Blacklisting - Manages token rotation and blacklisting to prevent replay attacks and revoke compromised sessions.
- Dual Symmetric and Asymmetric Support - Supports both symmetric (HS256) and asymmetric (RSA) signing algorithms for flexible security models.
- Configurable Signing Algorithms - Allows configuration of the cryptographic algorithms and keys used to sign and verify tokens.
- Authentication Validation Rules - Executes custom logic during the authentication process to determine if a validated user is permitted access.
- Digital Signatures - Supports various cryptographic signature algorithms like RSA and ECDSA to ensure token integrity.
- Token Hardening Techniques - Hardens API security by combining token rotation and blacklisting to prevent unauthorized access.
- Token Generation - Allows the programmatic creation of access and refresh token pairs for specific users.
- Token Invalidation - Implements the ability to invalidate specific refresh or sliding tokens by adding them to a blacklist.
- Sliding Window Expirations - Automatically extends token validity upon each use to maintain active user sessions.
- Password-Linked Revocations - Invalidates tokens by comparing the stored password hash in the payload against the current password.
- Token Claim Customizations - Allows adding custom claims to JWT access tokens to embed user metadata.
- Token Rotation Replay Prevention - Prevents replay attacks by blacklisting previously used refresh tokens after they have been rotated.
- API Development - JSON Web Token support for REST frameworks.
