see job log: https://travis-ci.org/James1345/django-rest-knox/jobs/409780228

HTTPError: 400 Client Error: User 'xxx.xxx' does not have a verified primary email address. Please add a verified primary email before attempting to upload to PyPI. See https://pypi.org/help/#verified-email for more information.for more information. for url: https://upload.pypi.org/legacy/

Original author was informed by me.

In auth.py

from django.utils.translation import ugettext_lazy as _ no longer works as ugettext_lazy is removed.

develop branch seems to have solved this issue.

Can a release be created?

Adds a encrypted field/column and support for encrypting the token with a passphrase. It also includes a tokens endpoint as well as hook into password change and reset as appropriate.

The idea is to support user's retrieving/managing their tokens in such a way that someone in possession of the DB still couldn't retrieve the tokens. Useful on a "API key management" screen that requires the user confirm that they are the logged in user by providing their login credentials for every token operation.

Can someone provide a short example or tutorial to explain how knox works? I have a DRF backend app and many client (web, ios, android). I would like to add some imprivment to my backend to allow the user to have a different token by client. But when I try to login trough api/auth/login/ endpoint, I got a error 401. When I look at the code, the LoginView need the user to be logged in. How is it possible to be logged in in the LoginView (that doesn't makes sens for me ^^)?

Thank you for your help!

First off, I am not sure why this doesnt already exist, maybe it was intentional but anyway here it is. This is allows a json request with username and password to be sent to an endpoint instead of using Basic HTTP Authentication.

For now this is simply disabled by default, ive added some tests but I reckon more is required since it aims to authenticate a user -- even though it relies on the authenticate() from django to do it.

• [ ] This PR does not incorporate another PRs Ive sent just yet, because they are still pending an answer: https://github.com/James1345/django-rest-knox/pull/109
• [ ] docs are not updated yet

As the readme doesn't really state it: django-rest-knox has a major performance issue.

https://github.com/James1345/django-rest-knox/blob/master/knox/auth.py#L50

This line leads to major performance hits once one reaches significant user numbers, as each API request leads to all tokens being sent do the Django instances. Once reaching a few tens of thousands of users and more than a handful of requests per second, the application is spending more time receiving/parsing SQL and guessing tokens than doing some actual work.

One way to change this would be the following: Split the token in 2 parts:

• Part one is an identifier for a database column, e.g. a random string
• Part two is the very token knox currently uses

This would lead to only querying for a single row (the one matching part on), then comparing one hash.

Funfact: While loadtesting I watched my servers handle > 100mbit/s of SQL due to this bug.

@belugame This is what I got thus far. I have verified the functionality manually -- it works but I am having trouble with the test not respecting the overridden TOKEN_LIMIT, thus the test fails -- I figured the default settings value should be None since this option does come with a performance cost and is not needed by everyone.

I mean I could just set knox_settings.TOKEN_LIMIT = 10 inside the testcase but.. is that the correct way?

Related: https://github.com/James1345/django-rest-knox/issues/108

Hi @belugame, @James1345

Thanks for creating django-rest-knox!

This feature will add an optional token prefix to the library that can be used to detect these tokens easily and quickly revoke them in case they are leaked. The same mechanism is also used by GitHub and GitLab. See also the issue: https://github.com/James1345/django-rest-knox/issues/271

This is just a MR to see, if you would accept that feature. I will provide tests and documentation, once you approve.

Fixes https://github.com/James1345/django-rest-knox/issues/271

@dlouzan @bufferoverflow @fh1ch @nejch

I would like to implement a method of refreshing tokens from a single page app. The refresh itself seems pretty simple, but I was wondering what the best way of accessing a token's expiration time is. I was thinking about overriding the login view to return the expiration time as well, but the manager method to create new tokens only returns the token's key. Any input would be much appreciated.

This is the second part, with a newer version. Prevents a break with existing installations. Unfortunately, this contains the commit of the other fork.

Hi guys, I really love this package and I regularly use it in projects that require token authentication. I recently came across a situation in which I needed to support multiple profiles for the user in a multi-platform project. So, it is required to link the token with both the user profile and the platform client. Hence, I came up with this solution and I hope that it would be of good use to the package users. Please, inform me if there is any unclear change and point out any change that needs further modifications. Thanks.

Add

• Django 4.1 has been released! https://docs.djangoproject.com/en/4.1/releases/4.1/
• Python 3.11 has been released!

Update

• GitHub Actions: Deprecating save-state and set-output commands https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
• Bump GH Actions versions

What is the recommended way to automatically generate an OpenAPI schema of the knox API endpoints? Neither the in the Django REST framework integrated schema builder (python manage.py generateschema) nor drf-spectacular seem to work out of the box.

Django==4.1.4 
psycopg2-binary==2.9.5
djangorestframework==3.14.0
django-cors-headers==3.13.0
django-rest-knox==4.2.0
cryptography==38.0.4
markdown==3.4.1
django-filter==22.1
pyyaml==6.0
uritemplate==4.1.1
coreapi==2.3.3
drf-spectacular==0.25.1 

  /api/login/:
    post:
      operationId: createLogin
      description: ''
      parameters: []
      requestBody:
        content:
          application/json:
            schema: {}
          application/x-www-form-urlencoded:
            schema: {}
          multipart/form-data:
            schema: {}
      responses:
        '201':
          content:
            application/json:
              schema: {}
          description: ''
      tags:
      - api
  /api/logout/:
    post:
      operationId: createLogout
      description: ''
      parameters: []
      requestBody:
        content:
          application/json:
            schema: {}
          application/x-www-form-urlencoded:
            schema: {}
          multipart/form-data:
            schema: {}
      responses:
        '201':
          content:
            application/json:
              schema: {}
          description: ''
      tags:
      - api
  /api/logoutall/:
    post:
      operationId: createLogoutAll
      description: 'Log the user out of all sessions

        I.E. deletes all auth tokens for the user'
      parameters: []
      requestBody:
        content:
          application/json:
            schema: {}
          application/x-www-form-urlencoded:
            schema: {}
          multipart/form-data:
            schema: {}
      responses:
        '201':
          content:
            application/json:
              schema: {}
          description: ''
      tags:
      - api

/home/worker/django/api/views.py:8: Error [LoginView]: unable to guess serializer. This is graceful fallback handling for APIViews. Consider using GenericAPIView as view base class, if view is under your control. Either way you may want to add a serializer_class (or method). Ignoring view for now.
/home/worker/django/api/views.py:8: Warning [LoginView]: could not resolve authenticator <class 'knox.auth.TokenAuthentication'>. There was no OpenApiAuthenticationExtension registered for that class. Try creating one by subclassing it. Ignoring for now.
/usr/local/lib/python3.11/site-packages/knox/views.py:70: Error [LogoutView]: unable to guess serializer. This is graceful fallback handling for APIViews. Consider using GenericAPIView as view base class, if view is under your control. Either way you may want to add a serializer_class (or method). Ignoring view for now.
/usr/local/lib/python3.11/site-packages/knox/views.py:70: Warning [LogoutView]: could not resolve authenticator <class 'knox.auth.TokenAuthentication'>. There was no OpenApiAuthenticationExtension registered for that class. Try creating one by subclassing it. Ignoring for now.
/usr/local/lib/python3.11/site-packages/knox/views.py:81: Error [LogoutAllView]: unable to guess serializer. This is graceful fallback handling for APIViews. Consider using GenericAPIView as view base class, if view is under your control. Either way you may want to add a serializer_class (or method). Ignoring view for now.
/usr/local/lib/python3.11/site-packages/knox/views.py:81: Warning [LogoutAllView]: could not resolve authenticator <class 'knox.auth.TokenAuthentication'>. There was no OpenApiAuthenticationExtension registered for that class. Try creating one by subclassing it. Ignoring for now.

...

  /api/login/:
    post:
      operationId: api_login_create
      tags:
      - api
      security:
      - {}
      responses:
        '200':
          description: No response body
  /api/logout/:
    post:
      operationId: api_logout_create
      tags:
      - api
      responses:
        '200':
          description: No response body
  /api/logoutall/:
    post:
      operationId: api_logoutall_create
      description: |-
        Log the user out of all sessions
        I.E. deletes all auth tokens for the user
      tags:
      - api
      responses:
        '200':
          description: No response body

Hello Know Team,

I tried this module, and its looks amazing, but I just noticed one thing on this app. its regarding the Auto Refresh method.

if auth_token.expiry is not None: if auth_token.expiry < timezone.now(): username = auth_token.user.get_username() auth_token.delete() token_expired.send(sender=self.__class__, username=username, source="auth_token") return True

above code line auto delete token if already expired even AUTO_REFRESH = True

As stated in the title, the PR that was most recently merged into the develop branch (#272) that adds the option for token prefixes undoes some of the work done in PR #275. Namely in the model.py file, the AuthTokenManager class lost it's **kwargs parameters so that you can't really populate any custom values to the AuthToken custom class you create...