Custom authentication backend not called with Django rest? - firebase

Question

I'm trying to use Firebase for my django rest / nuxt project and I need to verify the id tokens after the user logs in - I only use Firebase for the auth part.
My custom auth class looks like this:
class FirebaseAuthentication(authentication.BaseAuthentication):
def authenticate(self, request, **kwargs):
print("Why is this never called")
auth_header = request.META.get("HTTP_AUTHORIZATION")
if not auth_header:
raise NoAuthToken("No auth token provided")
id_token = auth_header.split(" ").pop()
decoded_token = None
try:
decoded_token = auth.verify_id_token(id_token)
except Exception:
raise InvalidAuthToken("Invalid auth token")
pass
if not id_token or not decoded_token:
return None
try:
uid = decoded_token.get("uid")
except Exception:
raise FirebaseError()
user, created = User.objects.get_or_create(email=uid)
user.profile.last_activity = timezone.localtime()
return (user, None)
And in my settings.py I got
REST_FRAMEWORK = {
"DEFAULT_AUTHENTICATION_CLASSES": (
"firebase.authentication.FirebaseAuthentication",
),
}
views.py
#require_POST
def login_view(request):
data = json.loads(request.body)
email = data.get("email")
password = data.get("password")
if email is None or password is None:
return JsonResponse({"detail": "Please provide email and password."}, status=400)
user = authenticate(email=email, password=password)
if user is None:
return JsonResponse({"detail": "Invalid credentials."}, status=400)
login(request, user)
return JsonResponse({"detail": "Successfully logged in.", "isAuthenticated": True})
And on my nuxt app, the login:
async login() {
this.error = null;
try {
const response = await firebase.auth().signInWithEmailAndPassword(this.email, this.password);
const token = await response.user.getIdTokenResult();
console.log(token.token);
const res = await fetch("/account/login/", {
method: "POST",
headers: {
"Content-Type": "application/json",
"HTTP_AUTHORIZATION": token.token,
"X-CSRFToken": this.$store.getters.CSRFToken
},
credentials: "include",
mode: "cors",
body: JSON.stringify({ email: this.email, password: this.password }),
});
return await res.json()
} catch (error) {
this.error = error;
}
},
I get a 200 everywhere - the user is logged in, both on firebase and on the django side of things, but the FirebaseAuthentication is not fired. What am I missing?

Answer 1

You are mixing two steps
Obtain JWT token from Firebase
Authenticate the user by django REST ("DEFAULT_AUTHENTICATION_CLASSES") by obtained JWT token from step 1.
Login view is unnecessary here. You already did it from Frontend side.
Now you should do; just write class based view (prefer class based view to function based view).
NB: authenticate function will call AUTHENTICATION_BACKENDS not DEFAULT_AUTHENTICATION_CLASSES under REST_FRAMEWORK dict.
from rest_framework.permissions import IsAuthenticated
class SampleProtectedAPIView(APIView):
permission_classes = (IsAuthenticated,) # Must include it to test user is authenticated
def post(self, request, *args, **kwargs):
print(request.user) # will get user instance