Using Django Sessions when views are accessed by API

Question

I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would like to make use of Django's Authentication features. My understanding is that Django Authentication makes use of Django sessions, which in turn abstracts the sending and receiving of cookies. My suspicion, therefore, is that if the setup looks like this:

User request <-> React app <-> API request <-> Django app

It's not going to work. Likely the cookie won't make it all the way to and from the user, and rather the React app itself is going to end up getting authenticated?

Is there a (sane, relatively straight forward) way to 'push' cookies through the react app to and from the user to make use of Django authentication of users in this setup? Or do I have to serve the client directly from the Django app?

Answer 1

Correct me if I've misunderstood, but I suspect it's more likely that the setup actually looks like this (as it's a common architecture for situations like yours):

╔═══════════╗
║  User's   ║ ◄———► React server
║  client   ║
║ (browser) ║ ◄———► Django/API server
╚═══════════╝

In this case, the flow when a user loads a page would be:

1. The client sends a request to the React server
2. The React server sends back a response
   • This is (usually) a single HTML file
   • Additional requests and responses are sent when the browser parses links to other files, like JavaScript, CSS, images, etc.
3. The React/JavaScript code is executed, which sends requests to the Django server
4. The Django server responds with the requested data
5. The client processes the response from the Django server

In other words, the React server will never directly communicate with the Django server, and when the client sends a login request, the Django server will respond with the session cookie directly to the client.