Is djangorestframework-jwt not good for http, https?

user_7093241 0
Viewed 73

I am trying to build an API server for http and started off with djangorestframework and someone suggested using djangorestframework-jwt. However, I saw this from their homepage.

Unlike some more typical uses of JWTs, this module only generates authentication tokens that will verify the user who is requesting one of your DRF protected API resources. The actual request parameters themselves are not included in the JWT claims which means they are not signed and may be tampered with. You should only expose your API endpoints over SSL/TLS to protect against content tampering and certain kinds of replay attacks.

Does djangorestframework-jwt work for http and https? Is it safe? If not, what is the alternative? Is this the approach for authentication in a REST API?

django-rest-framework-jwt django-rest-framework jwt rest django
1 Answers

Its http that isn't safe, nothing to do with the authentication method.

Initially, the user has to POST their login credentials. If those are sent via a http connection, anybody in between can read their username and password.

What's more, if you send the JWT token over http, somebody in between may just grab it and re-use it to authenticate their own queries against your API, until the token expires.

Good rule: if any kind of authentication is involved, use https.

user_55203540
Related