Authentication¶

Django authentication¶

The AuthMiddleware in Channels supports standard Django authentication, where the user details are stored in the session. It allows read-only access to a user object in the scope.

AuthMiddleware requires SessionMiddleware to function, which itself requires CookieMiddleware. For convenience, these are also provided as a combined callable called AuthMiddlewareStack that includes all three.

To use the middleware, wrap it around the appropriate level of consumer in your asgi.py:

from django.urls import re_path

from channels.routing import ProtocolTypeRouter, URLRouter
from channels.auth import AuthMiddlewareStack

from myapp import consumers

application = ProtocolTypeRouter({

    "websocket": AuthMiddlewareStack(
        URLRouter([
            re_path(r"^front(end)/$", consumers.AsyncChatConsumer.as_asgi()),
        ])
    ),

})

While you can wrap the middleware around each consumer individually, it’s recommended you wrap it around a higher-level application component, like in this case the URLRouter.

Note that the AuthMiddleware will only work on protocols that provide HTTP headers in their scope - by default, this is HTTP and WebSocket.

To access the user, just use self.scope["user"] in your consumer code:

class ChatConsumer(WebsocketConsumer):

    def connect(self, event):
        self.user = self.scope["user"]

Custom Authentication¶

If you have a custom authentication scheme, you can write a custom middleware to parse the details and put a user object (or whatever other object you need) into your scope.

Middleware is written as a callable that takes an ASGI application and wraps it to return another ASGI application. Most authentication can just be done on the scope, so all you need to do is override the initial constructor that takes a scope, rather than the event-running coroutine.

Here’s a simple example of a middleware that just takes a user ID out of the query string and uses that:

from channels.db import database_sync_to_async

@database_sync_to_async
def get_user(user_id):
    try:
        return User.objects.get(id=user_id)
    except User.DoesNotExist:
        return AnonymousUser()

class QueryAuthMiddleware:
    """
    Custom middleware (insecure) that takes user IDs from the query string.
    """

    def __init__(self, app):
        # Store the ASGI application we were passed
        self.app = app

    async def __call__(self, scope, receive, send):
        # Look up user from query string (you should also do things like
        # checking if it is a valid user ID, or if scope["user"] is already
        # populated).
        scope['user'] = await get_user(int(scope["query_string"]))

        return await self.app(scope, receive, send)

The same principles can be applied to authenticate over non-HTTP protocols; for example, you might want to use someone’s chat username from a chat protocol to turn it into a user.

How to log a user in/out¶

Channels provides direct login and logout functions (much like Django’s contrib.auth package does) as channels.auth.login and channels.auth.logout.

Within your consumer you can await login(scope, user, backend=None) to log a user in. This requires that your scope has a session object; the best way to do this is to ensure your consumer is wrapped in a SessionMiddlewareStack or a AuthMiddlewareStack.

You can logout a user with the logout(scope) async function.

If you are in a WebSocket consumer, or logging-in after the first response has been sent in a http consumer, the session is populated but will not be saved automatically - you must call scope["session"].save() after login in your consumer code:

from channels.auth import login

class ChatConsumer(AsyncWebsocketConsumer):

    ...

    async def receive(self, text_data):
        ...
        # login the user to this session.
        await login(self.scope, user)
        # save the session (if the session backend does not access the db you can use `sync_to_async`)
        await database_sync_to_async(self.scope["session"].save)()

When calling login(scope, user), logout(scope) or get_user(scope) from a synchronous function you will need to wrap them in async_to_sync, as we only provide async versions:

from asgiref.sync import async_to_sync
from channels.auth import login

class SyncChatConsumer(WebsocketConsumer):

    ...

    def receive(self, text_data):
        ...
        async_to_sync(login)(self.scope, user)
        self.scope["session"].save()