4 ms·
The way I've always done it is to not log the user in to a Django session. That way the SPA is the thing which holds the authentication, be it JWT or any other
by kennydude 8y ago
The way I've always done it is to not log the user in to a Django session. That way the SPA is the thing which holds the authentication, be it JWT or any other kind of token.
If any other site tries to POST to the API on behalf of the current user they'll get a "Authentication credentials required" message.