django-channels-jwt-stateless
Stateless JWT authentication middleware for Django Channels. Zero database queries on WebSocket handshake.
Existing Django Channels JWT packages call User.objects.get() on every
WebSocket connect. Under burst traffic this saturates the connection pool
and causes multi-second stalls. This package verifies the JWT signature
and builds a lightweight HandshakeUser from the token claims instead.
Install
pip install django-channels-jwt-stateless
Quick Start
# asgi.py
from channels.routing import ProtocolTypeRouter, URLRouter
from django_channels_jwt_stateless import JWTAuthMiddlewareStack
application = ProtocolTypeRouter({
"http": django_application,
"websocket": JWTAuthMiddlewareStack(URLRouter(websocket_urlpatterns)),
})
Works out of the box with djangorestframework-simplejwt defaults
(HS256, SECRET_KEY, user_id claim). Pass the token as ?token=<jwt>
in the WebSocket URL.
scope["user"]
On a valid token, scope["user"] is a HandshakeUser instance:
| Attribute | Value |
|---|---|
.id / .pk |
From the JWT user_id claim |
.is_anonymous |
False |
.is_authenticated |
True |
On an invalid, expired, or missing token it is AnonymousUser.
Configuration
Optional. Add to settings.py:
CHANNELS_JWT_STATELESS = {
"ALGORITHM": "HS256", # default
"SIGNING_KEY": None, # defaults to SECRET_KEY
"USER_ID_CLAIM": "user_id", # default
"TOKEN_QUERY_PARAM": "token", # default
"IS_BLACKLISTED": None, # dotted path to (jti) -> bool
"TOKEN_DECODER": None, # dotted path to (token) -> dict
"SUBPROTOCOL_PREFIX": None, # e.g. "access_token"
}
TOKEN_DECODER and IS_BLACKLISTED accept both sync and async callables.
Token Blacklisting
# myapp/auth.py
from django.core.cache import cache
async def is_blacklisted(jti: str) -> bool:
return await cache.aget(f"blacklist:{jti}") is not None
# settings.py
CHANNELS_JWT_STATELESS = {
"IS_BLACKLISTED": "myapp.auth.is_blacklisted",
}
Subprotocol Auth
To avoid leaking tokens in query strings:
CHANNELS_JWT_STATELESS = {"SUBPROTOCOL_PREFIX": "access_token"}
Client sends Sec-WebSocket-Protocol: access_token.<jwt>.
Compatibility
Python 3.10+, Django 4.2+, Channels 4+, PyJWT 2+.
License
MIT
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file django_channels_jwt_stateless-0.1.1.tar.gz.
File metadata
- Download URL: django_channels_jwt_stateless-0.1.1.tar.gz
- Upload date:
- Size: 7.4 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
21e6a22f29c32e4af0088ee063a23a45edb06756cdbce0dee4fc82aca944cd7e
|
|
| MD5 |
0342801e77b98b52ba8ab37b0ec7a7fa
|
|
| BLAKE2b-256 |
e23af4123960e5ff26396ee554725bb7473bbc39839430e69dee608c571d9544
|
Provenance
The following attestation bundles were made for django_channels_jwt_stateless-0.1.1.tar.gz:
Publisher:
publish.yml on zxzinn/django-channels-jwt-stateless
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
django_channels_jwt_stateless-0.1.1.tar.gz -
Subject digest:
21e6a22f29c32e4af0088ee063a23a45edb06756cdbce0dee4fc82aca944cd7e - Sigstore transparency entry: 2439168930
- Sigstore integration time:
-
Permalink:
zxzinn/django-channels-jwt-stateless@39730b05926f6d19b8ab0dbb5e1313e98a2ba77d -
Branch / Tag:
refs/tags/v0.1.1 - Owner: https://github.com/zxzinn
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@39730b05926f6d19b8ab0dbb5e1313e98a2ba77d -
Trigger Event:
push
-
Statement type:
File details
Details for the file django_channels_jwt_stateless-0.1.1-py3-none-any.whl.
File metadata
- Download URL: django_channels_jwt_stateless-0.1.1-py3-none-any.whl
- Upload date:
- Size: 7.0 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
366f06b22ecf09553611f0026ff6907a29b29fe573a6da8b361fa44b4211f452
|
|
| MD5 |
4b28230e812a171ff8e9edc28dfca46a
|
|
| BLAKE2b-256 |
9ef4b90ab4944795de07dd7cce3a7e7428c0e056691db9c97d762cbd9b55c877
|
Provenance
The following attestation bundles were made for django_channels_jwt_stateless-0.1.1-py3-none-any.whl:
Publisher:
publish.yml on zxzinn/django-channels-jwt-stateless
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
django_channels_jwt_stateless-0.1.1-py3-none-any.whl -
Subject digest:
366f06b22ecf09553611f0026ff6907a29b29fe573a6da8b361fa44b4211f452 - Sigstore transparency entry: 2439168940
- Sigstore integration time:
-
Permalink:
zxzinn/django-channels-jwt-stateless@39730b05926f6d19b8ab0dbb5e1313e98a2ba77d -
Branch / Tag:
refs/tags/v0.1.1 - Owner: https://github.com/zxzinn
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@39730b05926f6d19b8ab0dbb5e1313e98a2ba77d -
Trigger Event:
push
-
Statement type:
