Django internal API Client/Server Authentication o

Question

I have a django project, in which i expose a few api endpoints (api endpoint = answers to get/post, returns json response, correct me if im wrong in my definition). Those endpoints are used by me on front end, like update counts or get updated content, or a myriad other things. I handle the representation logic on server side, in templates, and in some cases send a rendered to string template to the client.

So here are the questions im trying to answer:

1. Do i need to have some kind of authentication between the clients and the server?
2. Is django cross origin protection enough?
3. Where, in this picture, fit such packages like django-oauth-toolkit? And django-rest-framework?
4. if i don't add any authentication between clients and server, am i leaving my server open for attacks?

Furthermore, what goes for server-to-server connection? Both servers under my control.

Answer 1

I would strongly recommend using django-tastypie for server to client communication. I have used it in numerous applications both server to server or server to client. This allows you to apply the django security as well as some more logic regarding the authorization process. It offers also out of the box:

• throttling
• serialization in json, xml, and other formats
• authentication (basic, apikey, customized and other)
• validation
• authorization
• pagination
• caching

So, as an overall overview i would suggest on building on such a framework that would make your internal api more interoperable for future extensions and more secure.

To specifically now answer your question, i would never enable any server api without at least some basic authentication/authorization.

Hopefully i answer your questions on how you can deliver all of your above worries with a framework.

The django-rest-framework that you ask for, is also really advanced and easy to use, but i prefer tastypie for the reasons i explain.

I hope i helped a bit!