1👍
Both approach can work very well. However, I am currently working on something similar and I would personally recommend the simpler option which is the classic session approach. JWT tokens can be harder to maintain and sometimes insecure if not done correctly. Also, JWT tokens will not persists between logins.
In both ways, I don’t see why one would be better to create and maintain a cart except maybe that a session system can actually store the complete cart in the session itself. You can then implement sessions controllers at the API level.
ex: GET "https://{host}/api/cart"
returns the items in the session’s cart.
# Django session
request.session['cart_id'] = cartId
# JWT Tokens
jwt.encode({‘cart_id’: cartId} ...
little note.. It can be harder to setup the sessions if you are working on localhost for react and a remote server for your API. (The cookies are generally set per domain).
0👍
I am using JWT, and I think if you are using a database, you can create a generated JWTby user then store it in the database, you can control the availability of your jwt, in parameters, and I find the best way to secure your APIs, is to add the JWT token to the headers.
- [Django]-Django custom User model authentication
- [Django]-Exception while installing packages in Python
- [Django]-How can I exclude rest-auth endpoint from the Django built-in API documentation?
- [Django]-How to populate database fields when model changes in django
0👍
I would use Cognito authentication and integrate it with react and the backend api. It will help to manage the users outside the application.
- [Django]-Redirect realtime common line output to Django HttpResponse
- [Django]-Caught DoesNotExist while rendering: Photo matching query does not exist
-1👍
If you’ll be hosting your application in AWS, Check out AWS Cognito, it’s an identity and a user pool service. Their free tier is quiet generous. That, together with AWS Amplify which is perfect for React, will give you out-of-the-box auth and user management.
- [Django]-How can I disable/remove authorize button in swagger drf_yasg (maintain CSRF) – django
- [Django]-Django middleware to determine user's group in a session
- [Django]-Django can not delete csrftoken after logout