djmongoauth provides out-of-the-box support for basic user management and additional operations including user registration, login, logout, email verification, password recovery for backends built with the Django web framework and MongoDB.
djmongoauth is based on djongo, a MongoDB ORM for Django.
Install djmongoauth through pip:
haotian@u8fZOlcHP:~$ sudo pip3 install djmongoauth
PyPI package can be found at https://pypi.org/project/djmongoauth/0.0.1/
User object is the core of the djmongoauth. It represents a authenticable entity. The primary attributes of a default user instance are:
usernameemailpasswordemail_verifiedemail_verified_at
def register(request):
req_body = json.loads(request.body.decode("UTF-8"))
user = User()
user.username = req_body["username"]
user.email = req_body["email"]
user.password = req_body["password"]
try:
user.register()
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
return HttpResponse(status=201)
request.methodmust bePOST- Body of
requestmust have these attributes and they must be well-formed:username,email,password. Password can be cleartext (djmongoauthtakes care of hashing / decryption)
def login(request):
try:
req_body = json.loads(request.body.decode("UTF-8"))
x_auth_token = User.login(req_body["username"], req_body["password"])
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
return JsonResponse({"token": x_auth_token})
request.methodmust bePOST- Body of
requestmust have these attributes:usernameandpassword login()call returns ax_auth_token. This token should be returned to your site's frontend and serve as a basic auth token in theHTTP_AUTHORIZATIONheader for all subsequent requests till the token expires
def logout(request):
try:
User.logout(request)
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
return HttpResponse(status=204)
requestmust have itsHTTP_AUTHORIATIONheader set to thex_auth_tokenreturned fromlogincall
# handler for verifying email address
def verify_email(request):
if request.method == "POST":
return _send_verify_email(request)
elif request.method == "PUT":
return _handle_email_verification(request)
else:
return HttpResponse(status=405)
def _send_verify_email(request):
try:
User.send_email(request, type=EmailTypes.VERIFY)
return HttpResponse(status=201)
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
def _handle_email_verification(request):
try:
User.handle_email_request(request, EmailTypes.VERIFY)
return HttpResponse(status=200)
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
A verification email will be sent to the user's registered email address. Following is a sample verification email:
Hello test_user:
Please use the following link to verify your email address on test.com
https://test.com/verify?a=wMw_qmXu8fZOlcHP1Xpku4e8nuo8rCQim0AHzp5Taqtk0CWq2sThbEMu5kVCcy5leVYDpHKfY6-fMc_4HZBbQg
This link will expire on 2021-09-12 02:04:21 UTC
Thank you for using test.com!
requestmust have itsHTTP_AUTHORIATIONheader set to thex_auth_tokenreturned fromlogincall- To send a verification email,
POSTthis endpoint; to handle a email verification request,PUTthis endpoint with parameteraset. Example:PUT https://api.test.com/verify?a=wMw_qmXu8fZOlcHP1Xpku4e8nuo8rCQim0AHzp5Taqtk0CWq2sThbEMu5kVCcy5leVYDpHKfY6-fMc_4HZBbQg - If using a hosted email domain service (example: GSuite), please ensure that options such as less secure apps are enabled (Gmail)
def reset_password(request):
if request.method == "POST":
return _send_recovery_email(request)
elif request.method == "PUT":
return _handle_password_recovery(request)
else:
return HttpResponse(status=405)
def _send_recovery_email(request):
try:
User.send_email(request, type=EmailTypes.RESET)
return HttpResponse(status=200)
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
def _handle_password_recovery(request):
try:
User.handle_email_request(request, EmailTypes.RESET)
return HttpResponse(status=200)
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
A password reset email will be sent to the user's registered email address. Following is a sample password reset email:
Hello test_user,
A request has been received to change the password for your account on test.com
Please follow this link to reset your password: https://test.com/reset?a=XfNKZT-OXXvvto3fDAyo5l46Ssmx1wQkXzlYGxQKyhFq3FTNve4vrvNYu8b8ha2erghRWtWfwFT5TT7O9xgM6Q
This link will expire on 2021-09-12 02:34:45 UTC
If you did not initiate this request, please ignore this email.
- To send a password reset email,
POSTthis endpoint; to handle a password reset request,PUTthis endpoint with parameter a set. Example:PUT https://api.test.com/reset?a=wMw_qmXu8fZOlcHP1Xpku4e8nuo8rCQim0AHzp5Taqtk0CWq2sThbEMu5kVCcy5leVYDpHKfY6-fMc_4HZBbQg - When
PUTting this endpoint, body ofrequestmust have these attributes:new_password.new_passwordcan be cleartext (djmongoauthtakes care of hashing / decryption)
@authenticated
Use this decorator on request handlers, etc. to ensure a user is already logged in
from djmongoauth.decorators.authenticated import authenticated
@authenticated
def my_other_view_handler(request):
pass
If a user is not properly authenticated (e.g. not logged in / login session has expired), a DjMongoAuthError will be raised
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent