OAuth2 and Django, What You Should Know
summary
Explains how the authorization code flow gives a Django server a token without exposing user credentials: redirect with client_id, scope, state parameter and a registered redirect_uri, exchange the one‑time code plus client secret for an access token over TLS, and use Bearer tokens in Authorization headers. Recommends python-social-auth for consumers, django-oauth-toolkit (backed by oauthlib) for provider/resource servers, and token validation via an introspection endpoint or out‑of‑band sync; warns about missing state, unvalidated redirects, non‑expiring codes, and lack of TLS.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:16Intro to OAuth
- 4:00OAuth 2.0 Vocabulary
- 6:02Before the flow
- 7:12Client to Auth. Server Redirect
- 9:04Authorization Code Flow
- 9:17Redirect back to clent
- 10:32Finally, a token
- 11:35What do I do with a token?
- 12:57Integrating OAuth 2
- 14:28What the spec. doesn't say
- 15:19OAuth 2 Packages for Django
- 18:53Python Social Auth Django Support
- 19:20Python Social Auth Summary
- 20:08Django OAuth Toolkit Views
- 20:34Django OAuth Toolkit with DRF
- 22:17Separate Django Resource Server
- 22:53Solution 1: Token validation view
related talks
29mDemystifying Oauth2 Authorization framework
26mIntegrating 2 factor authentication into your project
38mFinally Understand Authentication in Django REST Framework
33mOAuth2: Beyond The Specs
26mDeveloping a Single Sign On Service using Django
50mOAuth2 protocol
54mOAuth – the good Parts
21mNever build a login again : The art of using Social Auth with Django