How to use Graphene with Django REST Framework authentication

I got some REST API endpoints in Django and I wanted to use the same authentication for Graphene. The documentation does not provides any guidance.

I have authentication_classes = (TokenAuthentication,) in my API views. This was my solution:

urls.py:

# ...
from rest_framework.authentication import TokenAuthentication
from rest_framework.permissions import IsAuthenticated
from rest_framework.decorators import authentication_classes, permission_classes, api_view

def graphql_token_view():
    view = GraphQLView.as_view(schema=schema)
    view = permission_classes((IsAuthenticated,))(view)
    view = authentication_classes((TokenAuthentication,))(view)
    view = api_view(['GET', 'POST'])(view)
    return view

urlpatterns = [
# ...
    url(r'^graphql_token', graphql_token_view()),
    url(r'^graphql', csrf_exempt(GraphQLView.as_view(schema=schema))),
    url(r'^graphiql', include('django_graphiql.urls')),
# ...

Note that I added a new ^graphql_token endpoint and kept the original ^graphql which is used by the GraphiQL tool.

Then, I set the Authorization header in my GraphQL client and point to the graphql_token endpoint.

I created this issue in case anyone else has the same question. Also, posted the question and answer to StackOverflow.

[jacobh]

For my use I rolled the two above examples up into a single view class:

from graphene_django.views import GraphQLView

import rest_framework
from rest_framework.permissions import IsAuthenticated
from rest_framework.decorators import authentication_classes, permission_classes, api_view
from rest_framework.settings import api_settings


class DRFAuthenticatedGraphQLView(GraphQLView):
    def parse_body(self, request):
        if isinstance(request, rest_framework.request.Request):
            return request.data
        return super(APGraphQLView, self).parse_body(request)

    @classmethod
    def as_view(cls, *args, **kwargs):
        view = super(APGraphQLView, cls).as_view(*args, **kwargs)
        view = permission_classes((IsAuthenticated,))(view)
        view = authentication_classes(api_settings.DEFAULT_AUTHENTICATION_CLASSES)(view)
        view = api_view(['GET', 'POST'])(view)
        return view

[willianantunes]

Hi guys! I wrote a playground project with all you posted here.

The customized view:

https://github.com/willianantunes/django-graphql-playground/blob/151b59c29c648ce053937ea70ad07af0d7db74d9/api/graphql/views.py#L10

Its setup:

https://github.com/willianantunes/django-graphql-playground/blob/151b59c29c648ce053937ea70ad07af0d7db74d9/django_graphql_playground/urls.py#L29

And some integration tests with GraphQL clients:

• With prisma/python-graphql-client: https://github.com/willianantunes/django-graphql-playground/blob/151b59c29c648ce053937ea70ad07af0d7db74d9/api/tests/integration/test_urls.py#L87
• With graphql-python/gql: https://github.com/willianantunes/django-graphql-playground/blob/151b59c29c648ce053937ea70ad07af0d7db74d9/api/tests/integration/test_urls.py#L121

Thank you!