django-rest-framework-jwt | JSON Web Token Authentication support for Django REST | REST library

My suggestion:

1. When user logs in, user + password get sent to server and once validated, a token is generated and stored on server as well as sent back to client.

2. Client once receives the token, store it in local storage.

3. From then on, each time user make a request to server, attach the token to the request. On the server side, check for token in the incoming request and validate it against it with what server already is having.

4. If token is valid, perform the backend process.

However, a token should be generally short-lived (a few hours). This in general should come with a “refresh token”, a refresh token is used to refresh the access token and generally long-lived (a few months).

First thing: You have to understand that Decorators can only be used on functions, you can not use it in class based views the way you have used it. So its obvious that django viewsets will not accept the @login_required decorator.

So question is, can you decorate the methods of a class? the answer is, YES. Here is the django docs Decorating the class, its says,

To decorate every instance of a class-based view, you need to decorate the class definition itself. To do this you apply the decorator to the dispatch() method of the class.

A method on a class isn’t quite the same as a standalone function, so you can’t just apply a function decorator to the method – you need to transform it into a method decorator first. The method_decorator decorator transforms a function decorator into a method decorator so that it can be used on an instance method. For example: