Add temporary guest (Ephemeral user) to Django Rest Framework - django-rest-framework

Question

I need the following:
Regular User creates a Guest . This guest must have the ability to POST and GET from two Views.
I've created the following Guest Model:
class Guest(models.Model):
reservation = models.ForeignKey(Reservation, related_name='guests', on_delete=models.CASCADE)
keys = models.ManyToManyField(Key)
email = models.EmailField(blank=False)
phone = models.DecimalField(decimal_places=0, max_digits=10)
name = models.CharField(max_length=64)
created = models.DateTimeField(default=timezone.now)
state = models.IntegerField(default=1,validators=[MaxValueValidator(1),MinValueValidator(0)])
class Meta:
ordering = ['created']
This guest "user" is a short-lived one (After a few days is deleted) . I'd like to avoid having to create an User instance for each guest.
My approach would be to allow anonymous users on ViewA and ViewB, then, i'd check request['guest'] to get the guest's ID , retrieve it from database and compare request['headers'] token value.
As for permissions on DRF (Pseudo-code to get the idea)
class IsGuestActive(permissions.BasePermission):
def has_permission(self, request, view):
if request.user.is_anonymous()
guest_id = request['guest']
token = request['headers'].token
return (Guest.objects.get(pk=guest_id, token=token) is not None)
I'm very new to Django, my main questions are:
is my approach viable?
Should i create an User with foreign key to Guest and use groups instead?
I really appreciate any tips on what's the best way to create Ephemeral users like i need to.
Edit (1)
Regarding safety, it really is dangerous using a duct tape type of solution, because no middleware would be responsible for authenticating a guest (Making the system prone to inadvertently giving permissions). But the approach of analyzing the headers within a permission class is not that unfeasible. From official documentation:
class BlocklistPermission(permissions.BasePermission):
"""
Global permission check for blocked IPs.
"""
def has_permission(self, request, view):
ip_addr = request.META['REMOTE_ADDR']
blocked = Blocklist.objects.filter(ip_addr=ip_addr).exists()
return not blocked
We can see here, that META is used to validate an access .
I'll need to dig further.

Answer 1

I found a solution, that i think is viable, to create a temporary controlled access to a View, without having to create a custom User:
Exclaimer: This method seems to be somewhat secure, considering the ephemeral nature of the guests using the system. It does not address the issue of controlling sessions, or retrieving access.
The use-case: You need a guest to access Views, but guest needs special authorization. This Guest will be short-lived.
middleware.py
Create a middleware where you define request.guest = None
class SimpleMiddleware:
def __init__(self, get_response):
self.get_response = get_response
def __call__(self, request):
request.guest = None
models.py
Now, we'll define our guest to have primary key as a token value:
class Guest(models.Model):
reservation = models.ForeignKey(Reservation, related_name='guests', on_delete=models.CASCADE)
token = models.CharField(max_length=40, primary_key=True)
...
class Meta:
ordering = ['created']
verbose_name = 'Guest'
verbose_name_plural = 'Guests'
def save(self, *args, **kwargs):
if not self.token:
self.token = self.generate_key()
return super().save(*args, **kwargs)
def generate_key(self):
return binascii.hexlify(os.urandom(20)).decode()
def __str__(self):
return self.token
In my case, i send the guest a link with a token as a parameter.
As you don't want to store the token on localstorage or any other place that isn't an httpOnly cookie to avoid XSS attacks, define a View to respond to the first click of the link on the email:
class SetGuest(APIView):
authentication_classes = []
permission_classes = [permissions.AllowAny]
def get(self, request, token, format=None):
response = HttpResponse("", status=308)
response['Location'] = "http://localhost/index.html?redirect&action=confirm&status=success"
response.set_cookie(key='guest_token', value=token, path='/', samesite='Lax', max_age=3600*24*7, secure=False, httponly=True)
return response
This View will redirect your guest to a page, and set up the CSRF and guest_token cookie.
Define the decorator creating a decorators.py:
def validate_guest(view_func):
def wrapper(self, request, *args, **kwargs):
try:
token = request.COOKIES.get('guest_token')
request.guest = Guest.objects.get(token=token)
except Exception as e:
logger.debug(str(e))
return redirect('/api/')
return view_func(self, request, *args, **kwargs)
return wrapper
Now, to protect the view so it only works for guests with a token:
class GuestGetKeys(APIView):
authentication_classes = []
permission_classes = [IsGuest]
dec_list = [ensure_csrf_cookie]
#validate_guest
def get(self, request, format=None):
return Response({'status': 'valid', 'success': 'Guest is logged'}, status=status.HTTP_200_OK)
One can achieve the same without using the decorator, but permissions.py instead.
The reason i prefer not to, is because through decorators i can control redirects in a cleaner way.
why defining the new dict value using a middleware? I tried modifying the request object directly on the Decorator and on the permissions class, it simply doesn't work.
There are a few short-comings from this approach, like session revoking issues, there's no other way of starting a "session" other than accessing the link sent to the guest, tokens are plain text and a database breach would allow anyone access as guests. Sessions don't expire, and so on.