marqueurs404 / recipe-app-api Goto Github PK

This project doesn't use JWT but instead a simple Token authentication. The only way to store this would be to use a local cookie or localstorage, which are not the most secure options available for browser clients.

Alternatives:

1. Switch from TokenAuthentication to SessionAuthentication. See https://www.django-rest-framework.org/api-guide/authentication/#sessionauthentication. By default, the session cookie should be HttpOnly=True (docs).
2. Switch to use JWT. Preferred library: django-rest-framework-simplejwt.
   a. To go the extra mile, consider creating a custom view for setting the refresh token as a server side cookie by using httponly=True with the set_cookie() method available on the response object (docs).