Web727Token

A secure-by-default authentication framework for Django, Django REST Framework, and React.

Install once. Protect every request. Keep authentication out of your application code.

pip install web727token
npm install web727token

---

Why Web727Token?

Traditional authentication libraries provide JWT utilities and expect developers to wire everything together.

Web727Token takes a different approach.

It is a complete authentication framework that centralizes authentication, authorization, session management, refresh-token rotation, audit logging, device tracking, and rate limiting behind a single middleware.

Your application works with authenticated users—not authentication infrastructure.

Traditional JWT Libraries	Web727Token
Configure authentication on every view	Install middleware once
Developers work directly with JWTs	JWT is completely hidden
Manual authentication decorators	Middleware authenticates every request
Manual Axios interceptors	Included React SDK
Refresh logic written manually	Automatic refresh rotation
Session management varies by project	Built-in
Device tracking is custom	Built-in
Audit logging is custom	Built-in
Logout implementation differs	Standardized

---

Features

Authentication

• Middleware-driven authentication
• JWT hidden behind the framework
• Automatic authentication for every request
• Django & Django REST Framework support
• Custom Django User model support

Security

• Access token expiration
• Refresh token rotation
• Refresh-token reuse detection
• Automatic session invalidation
• Per-user account lockout
• Per-IP rate limiting
• Device tracking
• Audit logging
• Configurable token lifetimes

Frontend

• React SDK
• Automatic Authorization header attachment
• Silent token refresh
• Automatic retry after refresh
• Session restoration
• React authentication hook

---

Architecture

Web727Token does not introduce another authentication standard.

JWT is simply an internal implementation detail.

Only tokens.py understands JWT.

Everything else—including your application code—works only with authenticated users.

Client
   │
   ▼
Web727 React SDK
   │
   ▼
Authorization Header
   │
   ▼
Web727Middleware
   │
   ▼
request.web727
   │
   ▼
Application Code

---

Requirements

• Python 3.10+
• Django 5+
• Django REST Framework
• React 18+ (Frontend SDK)

---

Installation

Backend

pip install web727token

Frontend

npm install web727token

Run migrations:

python manage.py migrate

---

Backend Quick Start

Install the application.

# settings.py

INSTALLED_APPS = [
    ...
    "web727token",
]

Install the middleware.

MIDDLEWARE = [
    ...
    "web727token.middleware.Web727Middleware",
]

Enable Web727Token.

WEB727_ENABLED = True

Register framework URLs.

# urls.py

urlpatterns = [
    path("web727/", include("web727token.urls")),
    path("api/", include("myapp.urls")),
]

That's all.

Every request under /api/ is authenticated automatically.

No

• authentication_classes
• permission_classes
• IsAuthenticated

are required.

---

Using the Authenticated User

from rest_framework.views import APIView
from rest_framework.response import Response


class CustomerAPIView(APIView):

    def get(self, request):
        return Response({
            "id": request.web727.user.id,
            "username": request.web727.user.username,
        })

Every authenticated request automatically provides:

request.web727.user
request.web727.session
request.web727.device
request.web727.roles
request.web727.permissions
request.user

---

Frontend Quick Start

import { Web727 } from "web727token";

Web727.init();

await Web727.login("alice", "hunter2");

const profile = await Web727.client.get("/api/profile");

await Web727.logout();

Or use the React hook.

import { useWeb727Auth } from "web727token";

function LoginButton() {

    const {
        isAuthenticated,
        login,
        logout,
    } = useWeb727Auth();

    return isAuthenticated
        ? <button onClick={logout}>Logout</button>
        : <button onClick={() => login("alice", "hunter2")}>Login</button>;
}

The SDK automatically:

• Stores tokens
• Attaches Authorization headers
• Refreshes expired access tokens
• Retries failed requests
• Persists rotated refresh tokens

No Axios interceptor configuration is required.

---

Built-in Framework Endpoints

These endpoints are provided by Web727Token.

Method	Endpoint	Description
POST	/web727/login	Authenticate and create a session
POST	/web727/logout	Logout the current session
POST	/web727/refresh	Rotate the refresh token
GET	/web727/me	Current authenticated user
GET	/web727/session	List active sessions
GET	/web727/session/{id}	Get session details (planned)
DELETE	/web727/session/{id}	Revoke a specific session (planned)
DELETE	/web727/session	Logout from all devices (planned)
PUT	/web727/change-password	Change password
PATCH	/web727/profile	Update authenticated user profile (planned)
OPTIONS	/web727/*	Supported automatically by Django
HEAD	/web727/*	Supported automatically by Django

---

Supported HTTP Methods

Web727Middleware authenticates every incoming request regardless of HTTP method.

Supported methods include:

• GET
• POST
• PUT
• PATCH
• DELETE
• OPTIONS
• HEAD

Once authenticated, request.web727 is available for every supported request.

---

What's Included

Web727Token provides:

• Authentication middleware
• Login, logout and token refresh endpoints
• JWT token engine
• Session management
• Device tracking
• Login history
• Audit logging
• Role and permission support
• React SDK with automatic token management

---

Current Status

Backend

Completed

• Middleware authentication
• JWT token engine
• Session management
• Refresh token rotation
• Refresh-token reuse detection
• Automatic session invalidation
• Login history
• Device tracking
• Audit logging
• Per-user account lockout
• Per-IP rate limiting
• Role-based authorization
• Six built-in authentication endpoints

22 / 22 pytest-django tests passing

Verified through automated tests and successful package builds.

---

Frontend

Completed

• React SDK
• Login
• Logout
• Session restoration
• Automatic Authorization header
• Automatic refresh
• Automatic retry after refresh
• Refresh-token persistence
• React authentication hook
• Rollup CJS & ESM builds

14 / 14 Vitest tests passing

---

Roadmap

Planned improvements include:

• Cookie-based authentication documentation
• CSRF guidance for cookie deployments
• Session management UI example
• Device management UI example
• GitHub Actions CI/CD
• PyPI publishing workflow
• npm publishing workflow

---

Philosophy

Web727Token is not another JWT library.

JWT is deliberately isolated inside tokens.py.

Application developers never need to:

• Parse JWTs
• Validate JWTs
• Refresh JWTs
• Attach Authorization headers
• Configure authentication decorators
• Write Axios interceptors

Instead, developers simply work with authenticated users through request.web727.

---

License

MIT License