I'm making an app which is a Django backend and a React frontend (being developed by someone else). The plan currently is to fully decouple the two and have them communicate over API. However, I would like to make use of Django's Authentication features. My understanding is that Django Authentication makes use of Django sessions, which in turn abstracts the sending and receiving of cookies. My suspicion, therefore, is that if the setup looks like this:

User request <-> React app <-> API request <-> Django app

It's not going to work. Likely the cookie won't make it all the way to and from the user, and rather the React app itself is going to end up getting authenticated?

Is there a (sane, relatively straight forward) way to 'push' cookies through the react app to and from the user to make use of Django authentication of users in this setup? Or do I have to serve the client directly from the Django app?

  • I'm not sure how the cookie won't end up on the client. The cookie gets sent back with the API response. If the HttpOnly property of the cookie is not set, then JavaScript can access it via document.cookie. Subsequent API requests will include the cookie automatically because that is simply how the browser works. Commented Jan 8, 2020 at 22:51

1 Answer 1


Correct me if I've misunderstood, but I suspect it's more likely that the setup actually looks like this (as it's a common architecture for situations like yours):

║  User's   ║ ◄———► React server
║  client   ║
║ (browser) ║ ◄———► Django/API server

In this case, the flow when a user loads a page would be:

  1. The client sends a request to the React server
  2. The React server sends back a response
    • This is (usually) a single HTML file
    • Additional requests and responses are sent when the browser parses links to other files, like JavaScript, CSS, images, etc.
  3. The React/JavaScript code is executed, which sends requests to the Django server
  4. The Django server responds with the requested data
  5. The client processes the response from the Django server

In other words, the React server will never directly communicate with the Django server, and when the client sends a login request, the Django server will respond with the session cookie directly to the client.

Not the answer you're looking for? Browse other questions tagged or ask your own question.