Skip to content
This repository was archived by the owner on May 26, 2020. It is now read-only.

Commit 0bc4a93

Browse files
jpadillajpadilla
committed
Change authorization Bearer prefix for JWT
This changes the prefix for the HTTP Authorization header from Bearer to JWT to avoid conflicts with django-oauth2-provider.
1 parent e1e6aa3 commit 0bc4a93

File tree

2 files changed

+32
-26
lines changed

2 files changed

+32
-26
lines changed

‎rest_framework_jwt/authentication.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ class JSONWebTokenAuthentication(BaseAuthentication):
2121
Token based authentication using the JSON Web Token standard.
2222
2323
Clients should authenticate by passing the token key in the "Authorization"
24-
HTTP header, prepended with the string "Bearer ". For example:
24+
HTTP header, prepended with the string "JWT ". For example:
2525
26-
Authorization: Bearer eyJhbGciOiAiSFMyNTYiLCAidHlwIj
26+
Authorization: JWT eyJhbGciOiAiSFMyNTYiLCAidHlwIj
2727
"""
2828
www_authenticate_realm = 'api'
2929

@@ -34,14 +34,14 @@ def authenticate(self, request):
3434
"""
3535
auth = get_authorization_header(request).split()
3636

37-
if not auth or auth[0].lower() != b'bearer':
37+
if not auth or auth[0].lower() != b'jwt':
3838
return None
3939

4040
if len(auth) == 1:
41-
msg = 'Invalid bearer header. No credentials provided.'
41+
msg = 'Invalid JWT header. No credentials provided.'
4242
raise exceptions.AuthenticationFailed(msg)
4343
elif len(auth) > 2:
44-
msg = ('Invalid bearer header. Credentials string '
44+
msg = ('Invalid JWT header. Credentials string '
4545
'should not contain spaces.')
4646
raise exceptions.AuthenticationFailed(msg)
4747

@@ -78,4 +78,4 @@ def authenticate_header(self, request):
7878
header in a `401 Unauthenticated` response, or `None` if the
7979
authentication scheme should return `403 Permission Denied` responses.
8080
"""
81-
return 'Bearer realm="{0}"'.format(self.www_authenticate_realm)
81+
return 'JWT realm="{0}"'.format(self.www_authenticate_realm)

‎rest_framework_jwt/tests/test_authentication.py

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
from rest_framework_jwt.authentication import JSONWebTokenAuthentication
1515

1616

17+
DJANGO_OAUTH2_PROVIDER_NOT_INSTALLED = 'django-oauth2-provider not installed'
18+
1719
factory = APIRequestFactory()
1820

1921

@@ -31,10 +33,14 @@ def post(self, request):
3133
'',
3234
(r'^jwt/$', MockView.as_view(
3335
authentication_classes=[JSONWebTokenAuthentication])),
36+
3437
(r'^jwt-oauth2/$', MockView.as_view(
35-
authentication_classes=[JSONWebTokenAuthentication, OAuth2Authentication])),
38+
authentication_classes=[
39+
JSONWebTokenAuthentication, OAuth2Authentication])),
40+
3641
(r'^oauth2-jwt/$', MockView.as_view(
37-
authentication_classes=[OAuth2Authentication, JSONWebTokenAuthentication])),
42+
authentication_classes=[
43+
OAuth2Authentication, JSONWebTokenAuthentication])),
3844
)
3945

4046

@@ -56,7 +62,7 @@ def test_post_form_passing_jwt_auth(self):
5662
payload = utils.jwt_payload_handler(self.user)
5763
token = utils.jwt_encode_handler(payload)
5864

59-
auth = 'Bearer {0}'.format(token)
65+
auth = 'JWT {0}'.format(token)
6066
response = self.csrf_client.post(
6167
'/jwt/', {'example': 'example'}, HTTP_AUTHORIZATION=auth)
6268

@@ -70,7 +76,7 @@ def test_post_json_passing_jwt_auth(self):
7076
payload = utils.jwt_payload_handler(self.user)
7177
token = utils.jwt_encode_handler(payload)
7278

73-
auth = 'Bearer {0}'.format(token)
79+
auth = 'JWT {0}'.format(token)
7480
response = self.csrf_client.post(
7581
'/jwt/', {'example': 'example'},
7682
HTTP_AUTHORIZATION=auth, format='json')
@@ -91,38 +97,38 @@ def test_post_json_failing_jwt_auth(self):
9197
response = self.csrf_client.post('/jwt/', {'example': 'example'},
9298
format='json')
9399
self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
94-
self.assertEqual(response['WWW-Authenticate'], 'Bearer realm="api"')
100+
self.assertEqual(response['WWW-Authenticate'], 'JWT realm="api"')
95101

96-
def test_post_no_bearer_failing_jwt_auth(self):
102+
def test_post_no_jwt_header_failing_jwt_auth(self):
97103
"""
98104
Ensure POSTing over JWT auth without credentials fails
99105
"""
100-
auth = 'Bearer'
106+
auth = 'JWT'
101107
response = self.csrf_client.post(
102108
'/jwt/', {'example': 'example'},
103109
HTTP_AUTHORIZATION=auth, format='json')
104110

105-
msg = 'Invalid bearer header. No credentials provided.'
111+
msg = 'Invalid JWT header. No credentials provided.'
106112

107113
self.assertEqual(response.data['detail'], msg)
108114
self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
109-
self.assertEqual(response['WWW-Authenticate'], 'Bearer realm="api"')
115+
self.assertEqual(response['WWW-Authenticate'], 'JWT realm="api"')
110116

111-
def test_post_invalid_bearer_failing_jwt_auth(self):
117+
def test_post_invalid_jwt_header_failing_jwt_auth(self):
112118
"""
113119
Ensure POSTing over JWT auth without correct credentials fails
114120
"""
115-
auth = 'Bearer abc abc'
121+
auth = 'JWT abc abc'
116122
response = self.csrf_client.post(
117123
'/jwt/', {'example': 'example'},
118124
HTTP_AUTHORIZATION=auth, format='json')
119125

120-
msg = ('Invalid bearer header. Credentials string '
126+
msg = ('Invalid JWT header. Credentials string '
121127
'should not contain spaces.')
122128

123129
self.assertEqual(response.data['detail'], msg)
124130
self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
125-
self.assertEqual(response['WWW-Authenticate'], 'Bearer realm="api"')
131+
self.assertEqual(response['WWW-Authenticate'], 'JWT realm="api"')
126132

127133
def test_post_expired_token_failing_jwt_auth(self):
128134
"""
@@ -132,7 +138,7 @@ def test_post_expired_token_failing_jwt_auth(self):
132138
payload['exp'] = 1
133139
token = utils.jwt_encode_handler(payload)
134140

135-
auth = 'Bearer {0}'.format(token)
141+
auth = 'JWT {0}'.format(token)
136142
response = self.csrf_client.post(
137143
'/jwt/', {'example': 'example'},
138144
HTTP_AUTHORIZATION=auth, format='json')
@@ -141,13 +147,13 @@ def test_post_expired_token_failing_jwt_auth(self):
141147

142148
self.assertEqual(response.data['detail'], msg)
143149
self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
144-
self.assertEqual(response['WWW-Authenticate'], 'Bearer realm="api"')
150+
self.assertEqual(response['WWW-Authenticate'], 'JWT realm="api"')
145151

146152
def test_post_invalid_token_failing_jwt_auth(self):
147153
"""
148154
Ensure POSTing over JWT auth with invalid token fails
149155
"""
150-
auth = 'Bearer abc123'
156+
auth = 'JWT abc123'
151157
response = self.csrf_client.post(
152158
'/jwt/', {'example': 'example'},
153159
HTTP_AUTHORIZATION=auth, format='json')
@@ -156,9 +162,9 @@ def test_post_invalid_token_failing_jwt_auth(self):
156162

157163
self.assertEqual(response.data['detail'], msg)
158164
self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
159-
self.assertEqual(response['WWW-Authenticate'], 'Bearer realm="api"')
165+
self.assertEqual(response['WWW-Authenticate'], 'JWT realm="api"')
160166

161-
@unittest.skipUnless(oauth2_provider, 'django-oauth2-provider not installed')
167+
@unittest.skipUnless(oauth2_provider, DJANGO_OAUTH2_PROVIDER_NOT_INSTALLED)
162168
def test_post_passing_jwt_auth_with_oauth2_priority(self):
163169
"""
164170
Ensure POSTing over JWT auth with correct credentials
@@ -168,14 +174,14 @@ def test_post_passing_jwt_auth_with_oauth2_priority(self):
168174
payload = utils.jwt_payload_handler(self.user)
169175
token = utils.jwt_encode_handler(payload)
170176

171-
auth = 'Bearer {0}'.format(token)
177+
auth = 'JWT {0}'.format(token)
172178
response = self.csrf_client.post(
173179
'/oauth2-jwt/', {'example': 'example'},
174180
HTTP_AUTHORIZATION=auth, format='json')
175181

176182
self.assertEqual(response.status_code, status.HTTP_200_OK, response)
177183

178-
@unittest.skipUnless(oauth2_provider, 'django-oauth2-provider not installed')
184+
@unittest.skipUnless(oauth2_provider, DJANGO_OAUTH2_PROVIDER_NOT_INSTALLED)
179185
def test_post_passing_oauth2_with_jwt_auth_priority(self):
180186
"""
181187
Ensure POSTing over OAuth2 with correct credentials

0 commit comments

Comments
 (0)