API access authentication/application key (django/nginx/gunicorn)
<p>I have a web app created in django, running in gunicorn app server behind nginx webserver/reverse-proxy. I need to have external application to access some processed data (csv/json), for which I need some sort of authentication. The basic django auth/login is not optimal as a simple script needs to pull the data with a simple request, no cookies etc (not created by me).</p>

<p>For now, I have </p>

<ol>
<li><p>set up the service being available with https/tls only  </p></li>
<li><p>created an IP-filter in django to reduce the "attack surface" with:</p></li>
</ol>

<p><code>request.META['HTTP_X_REAL_IP']</code></p>

<p>and using nginx to forward the ip with:</p>

<pre><code>proxy_set_header X-Real-IP $remote_addr;
</code></pre>

<p>Next I was thinking to include and application key (hash of a pw or something) which needs to be included in the request, and is checked against db for a list of valid keys. </p>

<p>Is this a suitable api authentication or is there something else which can be used/recomennded? some sort of application key framework? </p>

<p>There are many authentication methods beside of session/cookie based ones. For your case I will suggest simple token authentication. Just save same token in your django app and external app and on each request from external app to django, send additional header:</p>

<pre><code>Authentication: Token YOUR_TOKEN_KEY
</code></pre>

<p>Now all you need to do in django is to fetch that token and check if it matches one saved locally.</p>

<p>If you want more auth options for API, check <a href="http://www.django-rest-framework.org/api-guide/authentication/" rel="nofollow">Django Rest Framework documentation</a>.</p>

python django nginx