Insecure Design in Django with Bearer Tokens

Insecure design in Django APIs that use Bearer tokens often arises from treating the token as a strong authentication boundary while omitting complementary controls such as scope validation, token binding, and transport protections. When developers rely solely on the presence of a Bearer token in the Authorization header, they implicitly accept any token issued by the identity provider, regardless of audience, scope, or revocation status.

Django REST Framework (DRF) and similar libraries simplify token handling but do not enforce semantic checks by default. A common pattern is to use TokenAuthentication or a custom header-based scheme that validates token existence but does not validate scope, issuer, or intended resource. This creates an insecure design where an attacker who obtains a token (for example, via logs, client-side storage, or a misconfigured frontend) can reuse it across endpoints, including those that require elevated permissions.

Another design flaw is the failure to enforce HTTPS consistently. If an API permits HTTP or accepts tokens over unencrypted channels, tokens can be intercepted. Insecure design also includes missing CSRF protections for state-changing endpoints when cookies are used for session fallbacks, and failure to validate the aud (audience) and iss (issuer) claims in token payloads. Without these checks, a token issued for one API audience might be accepted by another service, leading to privilege escalation or unauthorized data access.

The interaction between token-based design and Django’s permission system can inadvertently expose object-level authorization flaws. For example, a view that filters querysets by request.user may still allow BOLA/IDOR if the token identifies a user but the developer does not enforce per-object ownership checks. Insecure design here means assuming token possession equals authorization, rather than implementing explicit checks such as get_queryset filters or policy-based authorization.

Moreover, logging configurations that capture Authorization headers in plaintext, or middleware that inadvertently exposes tokens in error traces or monitoring data, constitute insecure design choices that amplify token leakage risks. Without short token lifetimes and refresh token rotation, compromised tokens remain valid for extended periods, increasing the window for abuse.

Remediation centers on strict validation of token metadata, scope enforcement, and secure transport. Use HTTPS exclusively and configure Django to reject insecure requests. Validate token claims and bind tokens to intended audiences and scopes.

1. Use DRF’s TokenAuthentication with scope validation

Extend the default token model to include scopes and validate them in authentication.

from rest_framework.authentication import BaseAuthentication
from rest_framework.exceptions import AuthenticationFailed
from .models import ScopedToken

class ScopedTokenAuthentication(BaseAuthentication):
    def authenticate(self, request):
        auth_header = request.headers.get('Authorization')
        if not auth_header or not auth_header.startswith('Bearer '):
            return None
        token = auth_header.split(' ')[1]
        try:
            scoped_token = ScopedToken.objects.get(key=token)
        except ScopedToken.DoesNotExist:
            raise AuthenticationFailed('Invalid token')
        # Validate scope for the requested view
        if not scoped_token.has_scope(self.required_scope(request)):
            raise AuthenticationFailed('Insufficient scope')
        return (scoped_token.user, None)

    def required_scope(self, request):
        # Map view to required scope
        if request.path.startswith('/admin/'):
            return 'admin'
        return 'read'

2. Validate issuer and audience with PyJWT

If using JWT Bearer tokens, validate claims explicitly rather than relying on opaque tokens.

import jwt
from django.conf import settings
from rest_framework.authentication import BaseAuthentication
from rest_framework.exceptions import AuthenticationFailed

class JWTBearerAuthentication(BaseAuthentication):
    def authenticate(self, request):
        auth_header = request.headers.get('Authorization')
        if not auth_header or not auth_header.startswith('Bearer '):
            return None
        token = auth_header.split(' ')[1]
        try:
            payload = jwt.decode(
                token,
                settings.JWT_PUBLIC_KEY,
                algorithms=['RS256'],
                audience='myapi.example.com',
                issuer='auth.example.com',
            )
        except jwt.ExpiredSignatureError:
            raise AuthenticationFailed('Token expired')
        except jwt.InvalidAudienceError:
            raise AuthenticationFailed('Invalid audience')
        except jwt.InvalidIssuerError:
            raise AuthenticationFailed('Invalid issuer')
        user_id = payload.get('sub')
        # Ensure user exists and is active
        from django.contrib.auth import get_user_model
        User = get_user_model()
        user = User.objects.filter(pk=user_id, is_active=True).first()
        if not user:
            raise AuthenticationFailed('User not found')
        return (user, None)

3. Enforce HTTPS and secure token storage

Configure Django to require secure cookies and reject HTTP requests that carry tokens.

# settings.py
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

Ensure your reverse proxy or load balancer sets X-Forwarded-Proto correctly. Reject requests that arrive over HTTP when tokens are present.

4. Bind tokens to resources and enforce object-level checks

Combine token validation with per-object ownership checks to prevent BOLA/IDOR.

from rest_framework import generics
from rest_framework.permissions import IsAuthenticated

class SecureDocumentView(generics.RetrieveAPIView):
    permission_classes = [IsAuthenticated]

    def get_queryset(self):
        # Scope or token metadata may include resource constraints
        return Document.objects.filter(owner=self.request.user)

5. Shorten lifetimes and rotate tokens

Implement short-lived access tokens and refresh token rotation. Store refresh tokens with one-time use semantics and bind them to client metadata.

# Example refresh token validation
if not refresh_token.is_valid_for_request(request):
    raise AuthenticationFailed('Invalid refresh token usage')

6. Avoid logging sensitive headers

Ensure Authorization headers are redacted in logging configurations and error reporting.

import logging
class SafeFilter(logging.Filter):
    def filter(self, record):
        if hasattr(record, 'message'):
            record.msg = record.message.replace('Authorization', 'Authorization=[REDACTED]')
        return True
logging.getLogger().addFilter(SafeFilter())