Empowering Your Django Backend with GraphQL: A Powerful Combination (Part — 2)

An overview of JWT Authentication with GraphQL and Django.

In our previous blog, “Empowering Your Django Backend with GraphQL: A Powerful Combination”, we explored the world of GraphQL and how it can supercharge your Django backend, providing more flexibility and efficiency in handling data requests. If you haven’t had a chance to read it yet, you can find it here.

Empowering Your Django Backend with GraphQL: A Powerful Combination

Now, as we go deeper into the facets of Django development, we’ll dive into another critical aspect of modern web applications: Authentication.

Security is paramount, and one of the most widely adopted methods for securing APIs is JSON Web Token (JWT) authentication.

In this follow-up blog, we’ll explore how to implement JWT authentication in your Django project. We’ll walk through the process step by step, and by the end of this guide, you’ll have a clear understanding of how to secure your Django backend with JWTs, ensuring that your data and endpoints are only accessible to authorized users.

Whether you’re building a web application from scratch or looking to enhance the security of your existing Django project, this guide will equip you with the knowledge and tools needed to implement JWT authentication effectively.

So, let’s get started on our journey to bolster the security of your Django backend with JWT authentication. But first, if you haven’t already, make sure to catch up on the foundational concepts we covered in our previous blog on GraphQL and Django. Then, join us as we take your Django application’s security to the next level.

Understanding JSON Web Token

JWTs are compact, self-contained tokens that are designed for securely transmitting information between parties, typically between a client and a server. They consist of three parts: a header, a payload, and a signature.

1. Header: The header typically consists of two parts: the type of the token, which is JWT, and the signing algorithm being used, such as HMAC SHA256 or RSA.

2. Payload: The payload contains claims, which are statements about an entity (typically, the user) and additional data. There are three types of claims: registered, public, and private claims. Registered claims are predefined, like “iss” for issuer and “exp” for expiration time. Public claims are defined in the JWT specification but are not mandatory to use. Private claims are custom claims created by the parties involved.

3. Signature: To create the signature part, you take the encoded header, the encoded payload, a secret (or private key), and the algorithm specified in the header, and you sign that.

Structure of JSON Web Token

Benefits of JSON Web Token

1. Security: JWTs can be digitally signed, ensuring that the token has not been tampered with during transmission. This signature provides integrity and authenticity to the data within the token.

2. Stateless: JWTs are stateless, meaning the server doesn’t need to store session information for each user. All necessary information is contained within the token itself, making it scalable and efficient.

3. Cross-Domain Compatibility: JWTs can be used across different domains and platforms, making them versatile for implementing single sign-on (SSO) solutions.

4. Decentralized: Since JWTs are self-contained, they allow for decentralized authentication. Different services can issue JWTs, and as long as they share the same signing key, they can trust each other’s tokens.

5. Customizable: You can include custom claims in JWTs, which makes them adaptable to various use cases beyond basic authentication, such as user roles and permissions.

Implementing JWT Authentication with Django & GraphQL

Let’s start by initiating a new application:

python manage.py startapp users

We will be using django-graphql-jwt package as a helper to implement JWT authentication functionality. You can read more about this package here: https://github.com/flavors/django-graphql-jwt).

pip install django-graphql-jwt

Next, we will be updating our settings file by adding new applications and config for JWT authentication:

# core/settings.py

INSTALLED_APPS = [
    "django.contrib.admin",
    "django.contrib.auth",
    "django.contrib.contenttypes",
    "django.contrib.sessions",
    "django.contrib.messages",
    "django.contrib.staticfiles",
    # local_apps
    "blog.apps.BlogConfig",
    "users.apps.UsersConfig",
    # installed_apps
    "graphene_django",
    "graphql_jwt.refresh_token.apps.RefreshTokenConfig",
]
GRAPHQL_JWT = {
    "JWT_AUTH_HEADER_PREFIX": "Bearer",
    "JWT_VERIFY_EXPIRATION": True,
    "JWT_LONG_RUNNING_REFRESH_TOKEN": True,
    "JWT_EXPIRATION_DELTA": timedelta(minutes=10),
    "JWT_REFRESH_EXPIRATION_DELTA": timedelta(days=7),
    "JWT_SECRET_KEY": SECRET_KEY,
    "JWT_ALGORITHM": "HS256",
}
GRAPHENE = {
    "SCHEMA": "core.schema.schema",
    "MIDDLEWARE": [
        "graphql_jwt.middleware.JSONWebTokenMiddleware",
    ],
}
AUTHENTICATION_BACKENDS = [
    "graphql_jwt.backends.JSONWebTokenBackend",
    "django.contrib.auth.backends.ModelBackend",
]

Create GraphQL schema and resolvers using Graphene-Django for Users application:

# users/schema.py

import graphene
import graphql_jwt
from django.contrib.auth import get_user_model
from graphene_django import DjangoObjectType
from graphql_jwt.decorators import login_required
from graphql_jwt.shortcuts import create_refresh_token, get_token
class UserType(DjangoObjectType):
    class Meta:
        model = get_user_model()

class CreateUser(graphene.Mutation):
    user = graphene.Field(UserType)
    token = graphene.String()
    refresh_token = graphene.String()
    class Arguments:
        username = graphene.String(required=True)
        password = graphene.String(required=True)
        email = graphene.String(required=True)
    def mutate(self, info, username, password, email):
        user = get_user_model()(
            username=username,
            email=email,
        )
        user.set_password(password)
        user.save()
        token = get_token(user)
        refresh_token = create_refresh_token(user)
        return CreateUser(user=user, token=token, refresh_token=refresh_token)

class Query(graphene.ObjectType):
    whoami = graphene.Field(UserType)
    users = graphene.List(UserType)
    def resolve_whoami(self, info):
        user = info.context.user
        # Check if user is authenticated
        if user.is_anonymous:
            raise Exception("Authentication Failure: Your must be signed in")
        return user
    # Check if user is authenticated using decorator
    @login_required
    def resolve_users(self, info):
        return get_user_model().objects.all()

class Mutation(graphene.ObjectType):
    token_auth = graphql_jwt.ObtainJSONWebToken.Field()
    refresh_token = graphql_jwt.Refresh.Field()
    verify_token = graphql_jwt.Verify.Field()
    create_user = CreateUser.Field()

schema = graphene.Schema(query=Query, mutation=Mutation)

Now, let’s register our schema and resolver from Users application to the project root:

# core/schema.py

import graphene
import blog.schema
import users.schema

class Query(blog.schema.Query, users.schema.Query, graphene.ObjectType):
    # Combine the queries from different apps
    pass

class Mutation(blog.schema.Mutation, users.schema.Mutation, graphene.ObjectType):
    # Combine the mutations from different apps
    pass

schema = graphene.Schema(query=Query, mutation=Mutation)

That’s it. Let’s create a new user using GraphiQL Frontend:

mutation{
  createUser(email:"mitulrathod86@gmail.com", username:"mitul", password:"MutationTest1"){
    user{
      id,
      username,
      email
    },
    token,
    refreshToken
  }
}

Response:

Now, let’s try to access one of our protected routes without JWT token:

query{
  whoami{
    username
  }
}

Response:

As expected, we won’t be able to access the protected route without access_token. So let’s get access_token by logging in to our user, which we created above, and adding it to Authorization Headers for further requests:

mutation{
  tokenAuth(username:"mitul",password:"MutationTest1"){
    token,
    refreshToken,
    refreshExpiresIn,
    payload
  }
}

Response:

Adding access_token to Authorization Headers and making the same whoami query:

Now, we will be able to see the response of the protected route.

Things to Take Care of While Implementing JWT with Django & GraphQL

Implementing JWT (JSON Web Token) authentication in your Django project alongside GraphQL can significantly enhance your application’s security and flexibility. However, it’s essential to approach this integration with careful consideration to ensure a smooth and secure user experience. Here are several key aspects to keep in mind while implementing JWT with Django and GraphQL:

1. Security Measures: Prioritize security throughout the implementation process. Store sensitive information, such as secret keys, securely. Use strong encryption algorithms and secure practices to protect your tokens and user data.
2. Token Expiration: Set reasonable token expiration times. Short-lived tokens reduce the window of opportunity for potential attackers but require more frequent re-authentication.
3. Token Revocation: Implement a mechanism for token revocation. This allows you to invalidate tokens if a user logs out or in case of a security breach.
4. User Authentication: Ensure that your Django backend authenticates users correctly before issuing tokens. Implement a robust user authentication system that validates user credentials securely.
5. User Authorization: JWTs typically handle authentication, but you’ll also need to manage user authorization. Define clear roles and permissions for your users and check these permissions before granting access to specific GraphQL operations.
6. Error Handling: Implement clear and informative error handling. Ensure that error messages do not reveal sensitive information, such as the reason for authentication failures.
7. Rate Limiting: Consider implementing rate limiting for GraphQL queries and mutations to prevent abuse or DoS (Denial of Service) attacks. This helps maintain the performance and availability of your GraphQL API.
8. Logging and Monitoring: Set up comprehensive logging and monitoring to keep track of authentication and authorization-related activities. Monitoring tools can alert you to suspicious or unauthorized access attempts.
9. Token Payload: Be cautious about the information you include in the token’s payload. Minimize the amount of sensitive data stored in the token to reduce the risk of data exposure.
10. Cross-Origin Resource Sharing (CORS): Implement CORS policies to control which domains can access your GraphQL API. This prevents unauthorized cross-origin requests.
11. Testing and Validation: Thoroughly test your JWT authentication implementation. Verify that tokens are generated, validated, and revoked correctly. Conduct security audits and penetration testing to identify vulnerabilities.
12. Documentation: Document the authentication and authorization process clearly for developers and users. Explain how users can obtain and use JWTs for authentication.
13. Scalability: Ensure that your JWT authentication implementation is scalable. As your application grows, consider factors like token storage and management.
14. Token Refresh: Implement token refresh functionality to allow users to obtain a new token without re-entering their credentials. This enhances user convenience and security.
15. Compliance: If your application handles user data subject to legal regulations (e.g., GDPR), ensure that your JWT implementation complies with these requirements, such as data protection and user consent.

By addressing these considerations, you can create a robust and secure JWT authentication system for your Django and GraphQL application. Balancing security, usability, and performance is key to providing a secure and user-friendly experience for your application’s users.

Disadvantages of JWT (JSON Web Tokens)

While JSON Web Tokens (JWTs) offer several advantages for authentication and authorization in web applications, they also come with certain disadvantages and limitations that should be carefully considered when deciding whether to implement them.

1. Stateless Nature: JWTs are inherently stateless, which means the server doesn’t store any information about the token. While this is an advantage for scalability, it can be a disadvantage when you need to invalidate or revoke tokens before their expiration time. Implementing token revocation can be challenging and may require additional mechanisms.
2. Token Size: JWTs can become large, especially if they carry a lot of information in their payload. This can result in increased network traffic and slower performance, particularly on low-bandwidth connections.
3. No Centralized Management: JWTs lack centralized management. Once issued, a JWT remains valid until it expires or is revoked. This can be problematic if you need to log out a user from all devices or manage access tokens centrally.
4. Limited Built-in Security: While JWTs can be signed and encrypted to ensure data integrity and confidentiality, they do not provide built-in protection against cross-site request forgery (CSRF) attacks or cross-site scripting (XSS) vulnerabilities. Developers must implement additional security measures to mitigate these risks.
5. Complexity for Beginners: Understanding and implementing JWTs correctly can be complex, especially for developers new to web security. Mistakes in token handling or validation can lead to security vulnerabilities.
6. Risk of Token Leakage: If not handled properly, JWTs can potentially expose sensitive user information in the payload. Developers must be cautious about including sensitive data in tokens and follow best practices for securing the payload.
7. Token Expiry Handling: Managing token expiration and refreshing tokens can add complexity to the authentication flow. Developers need to implement logic to handle token renewal and reauthentication when tokens expire.
8. Limited Token Revocation: Revoking individual JWTs can be challenging. To address this limitation, you may need to maintain a list of revoked tokens or use a different authentication mechanism for scenarios where token revocation is crucial.
9. Increased Server Load: Verifying JWT signatures and decoding the payload can consume server resources, especially when handling a high volume of requests. Caching and optimization techniques may be required to mitigate this.
10. Compatibility: While JWT is a widely adopted standard, not all platforms and libraries support it out of the box. Compatibility issues can arise when integrating JWT-based authentication with various technologies.
11. No Built-in Session Management: Unlike traditional session-based authentication, JWTs do not inherently support features like session expiration or automatic logout after a period of inactivity. These features must be implemented separately.

Despite these disadvantages, JWTs remain a popular choice for authentication in many web applications due to their flexibility, scalability, and compatibility with modern architectures. When using JWTs, it’s essential to carefully consider the trade-offs and take appropriate measures to address their limitations while leveraging their benefits effectively.

Key Learnings

1. Django and GraphQL: Django is a powerful Python web framework that provides a solid foundation for building web applications. GraphQL is a query language for APIs that enables efficient data retrieval and allows clients to specify the exact data they need.
2. Graphene: Graphene is a Python library that integrates GraphQL with Django, making it easy to build GraphQL APIs using Django models and resolvers.
3. GraphQL Schema: The GraphQL schema defines the structure and behavior of your API. By defining types, queries, and mutations in the schema, you can expose the available operations to clients.
4. JWT Authentication: JSON Web Token (JWT) is a popular authentication mechanism that enables secure communication between a client and a server. By implementing JWT authentication, you can provide a secure and stateless authentication mechanism for your Django + GraphQL API.

Conclusion

In this article, we walked you through the implementation of JWT Authentication with Django + GraphQL using django-graphql-jwt. By adding an authentication layer, we successfully built a secure and robust API. You can find the source code of this article here.

For more updates on the latest tools and technologies, follow the Simform Engineering blog.

Follow Us: Twitter | LinkedIn