I am trying to get some suggestions on how I should architect the authentication system for a Django rest framework API.
The stack looks like this:
Django REST framework
Django REST framework MongoEngine
Django REST framework JWT
Django REST framework Auth0
Since we have a Mongo data base, we are using MongoEngine and rest_framework_mongoengine for our models.
The discussions we had yielded two options for authentication.
One is to use the normal permission class system provided by the rest framework. Upon receiving the JWT the first time, a Django user object and a session would be created and the user would be marked as authenticated in that session.
The other one is to build a custom middleware that would ensure, based on the JWT, that the user has the necessary permissions for the resource it attempts to access and the action it attempts to perform.
The first option is simpler. The disadvantage would be the session, which goes again REST principles. This may also impact scalability since users will be bound to a particular server.
The second option, while a little harder to implement, would maintain the REST principle of statelessness. However, it also impacts performance since the check must be performed for all calls.
What do you think of these trade-offs. Do you see one being more advantages in general than the other?
Also, do you have suggestions regarding a better architecture?
If you were to implement a authentication system for a Django REST framework app using Auth0, how would you go about doing it?