django-react-auth-simple

JWT-based authentication starter built with Django REST Framework (backend) and React + Vite (frontend). Includes signup, login, logout, token refresh, and protected routes.

Features

• 🔐 JWT authentication (SimpleJWT) — access token in memory/localStorage, refresh token in httpOnly cookie
• 👤 Custom User model with unique email constraint
• 🔄 Automatic token refresh via axios interceptor (with retry-loop protection)
• 🛡️ Protected routes on the frontend (ProtectedRoute)
• 🚪 Logout with refresh-token blacklist
• 🌐 CORS configured for local development

Tech Stack

Layer	Technologies
Backend	Django 5.2, Django REST Framework, SimpleJWT, python-decouple, SQLite
Frontend	React 19, Vite 7, react-router-dom 7, axios, jwt-decode

Project Structure

django-react-auth-simple/
├── backend/
│   ├── config/          # Django project settings, urls, wsgi/asgi
│   ├── accounts/        # Auth app: models, serializers, views, urls
│   ├── manage.py
│   └── requirements.txt
└── frontend/
    └── src/
        ├── context/     # AuthProvider (token state + interceptors)
        ├── services/    # axios instance
        ├── components/  # ProtectedRoute
        ├── pages/       # Login, Signup, Dashboard, Home
        └── utils/       # token helpers

Getting Started

Backend

cd backend
python -m venv venv
venv\Scripts\activate          # Windows
# source venv/bin/activate     # Linux/macOS
pip install -r requirements.txt

Create a .env file inside backend/:

SECRET_KEY=your-secret-key-here
DEBUG=True

Run migrations and start the server:

python manage.py migrate
python manage.py runserver

Backend runs at http://localhost:8000.

Frontend

cd frontend
npm install
npm run dev

Frontend runs at http://localhost:5173.

API Endpoints

Base path: /accounts/

Method	Endpoint	Description	Auth
POST	/signup/	Register a new user	No
POST	/login/	Log in, returns access, sets refresh cookie	No
POST	/token/refresh/	Get a new access token from refresh cookie	No
POST	/logout/	Blacklist refresh token, clear cookie	Yes
GET	/me/	Get current user profile	Yes

Notes

• .env, venv/, db.sqlite3, and node_modules/ are git-ignored — never commit secrets.
• Cookie settings (secure=False, samesite=Lax) are tuned for development. Set secure=True and review samesite for production.

License

For learning/portfolio purposes.