Authentication vs Authorization: How DRF Handles Security

Learn how DRF handles authentication, why HTTP is stateless, and which method to use.

Authentication vs Authorization

| Concept            | Question it answers | Example                             |
| ------------------ | ------------------- | ----------------------------------- |
| Authentication     |  Who are you?       | Logging in with username & password |
| Authorization      |  What can you do?   | Only authors can edit their posts   |

Authentication always happens first. No identity = no permissions.

The Big Problem: HTTP has Goldfish Memory HTTP forgets everything between requests. Your API cannot remember a user unless the user sends proof every time.

So each request must carry a credential badge

DRF Authentication (built-in) Django REST Framework gives you four main tools. Think of them as different types of security badges.

1. Basic Authentication How it works

• Username + password send with every request Encoded (not encrypted) in headers Pros:
• Very simple
• Good for testing Cons:
• Password send each time
• Not safe without HTTPS
• Not used in production APIs Verdict : Training wheels only.

2. Session Authentication How it works

• User logs in one
• Server creates a session
• Browser stores a session
• Cookie is sent automatically with each request Pros:
• Great for web apps
• Works with Django admin & Browsable API Cons:
• Requires cookies
• Not ideal for mobile apps or third-party clients Verdict : Perfect for traditional Django websites, less ideal for public APIs.

3. Token Authentication How it works

• User logs in once
• Server gives a token (like a permanent access card)
• Client sends token in header every request Authorization: Token abc123xyz Pros:
• No password after login
• Good for mobile apps
• Simple to implement Cons:
• Token does not expire by default
• Must be stored securely on client Verdict : Excellent starter choice for APIs

4. DefaultAuthentication ? This is not real method itself. It just means DRF uses whatever you define in:

REST_FRAMEWORK = {
    "DEFAULT_AUTHENTICATION_CLASSES": [...]
}