django-session-jwt 0.4

Installation

This module respects the settings for django.contrib.sessions and provides additional options for controlling the JWT.

pip install django-session-jwt

Then modify settings.py:

SESSION_ENGINE='django_session_jwt.engine'
SESSION_COOKIE_NAME='sessionid'

DJANGO_SESSION_JWT = {
    'FIELDS': (
        'a list',
        ('of attributes', 'a'),
        'of the user',
        ('object to place', 'p'),
        'in the jwt',
    ),
    'KEY': 'string value or path to PEM key file',
    ,
    ...
}

As an optimization, the FIELDS list can contain tuples ('field_name', 'sn') providing a short name for the field. The JWT will contain the short name, but it will be converted when decoded. This can help reduce the size of the jWT.

Using the JWT

By default, the JWT will contain a single value "sk" and will be slightly larger than the default session cookie. The whole point of this application is to allow you to add additional fields to the JWT that can be used by other services running along side your Django application.

Once installed and configured, the browser will send the session cookie with each request. This cookie is verified and the sk / session key is utilized to set up Django sessions within the Django application. External applications can utilize the JWT directly, so you should define any “global” fields in the DJANGO_SESSION_JWT['FIELDS'] list / tuple. This way, legacy data stored within Django’s session does not pollute the JWT and vice/versa.

You can use a symmetric key or asymmetric key pair. In the simplest case, you can set DJANGO_SESSION_JWT['KEY'] = SECRET_KEY. You will then need to distribute the SECRET_KEY to all federated services. Another option is to use an asymmetric key pair such as an RSA key pair. This way the Django application alone holds the private key for signing JWTs while federated services hold only the public key for verifying the signature. A hybrid configuration might share the private key with a number of federated services for the purpose of issuing or extending JWTs while limiting other services to just the public key.

No library is provided for consuming the JWT, federated services should use available JWT libraries for verifying and extracting fields from the JWT.