DRF Authentication Classes
Authentication classes run in order during dispatch and set request.user from credentials: SessionAuthentication reuses Django's session cookie (and therefore enforces CSRF), TokenAuthentication matches an opaque database token from the Authorization header, and JWT authentication verifies a signed, self-contained token without a database lookup. Authentication only establishes identity; it never denies access by itself.
This Concept is waiting for its first lesson!
Authentication classes run in order during dispatch and set request.user from credentials: SessionAuthentication reuses Django's session cookie (and therefore enforces CSRF), TokenAuthentication matches an opaque database token from the Authorization header, and JWT authentication verifies a signed, self-contained token without a database lookup. Authentication only establishes identity; it never denies access by itself.
Are you a teacher? Sign in to start contributing.
Sign In