I have the same API login code for my develop and stage versions. The staging server is with cluster 1.20 instead of 1.19 ( in the developing server). I am not using Nginx we are using an HAProxy-based ingress controller.
Django API can access through the web using the ReactJS code but API shows 403 error when accessing through postman
Here is the code:
@csrf_protect
@api_view(["POST"])
@authentication_classes((LoginAuthentication,))
@permission_classes((IsAuthenticated,))
def api_login(request):
"""Log in and retrieve tokens based on user name and password"""
auth_header = request.META.get('HTTP_AUTHORIZATION')
encoded_credentials = auth_header.split(' ')[1] # Removes "Basic " to isolate credentials
decoded_credentials = base64.b64decode(encoded_credentials).decode("utf-8").split(':')
username = decoded_credentials[0]
password = decoded_credentials[1]
user = authenticate(username=username,password=password)
if user is not None:
login(request,user)
return _get_jwt_token(request.user)
def _get_jwt_token(user):
"""Helper function to generate jwt tokens"""
jwt_payload_handler = api_settings.JWT_PAYLOAD_HANDLER
jwt_encode_handler = api_settings.JWT_ENCODE_HANDLER
payload = jwt_payload_handler(user)
exp_str = payload["exp"].isoformat() + "Z"
token = jwt_encode_handler(payload)
refreshToken = _get_refresh_token(user)
return JsonResponse(
{"token": token, "refreshToken": refreshToken, "exp": exp_str}, status=201
)
console output of develop
[02/Nov/2022 10:41:06] "POST /accounts/api/login/ HTTP/1.1" 201 541
[02/Nov/2022 10:41:06] "POST /accounts/jwt_token/ HTTP/1.1" 201 541
[02/Nov/2022 10:41:06] "POST /accounts/get_csrf/ HTTP/1.1" 200 82
[02/Nov/2022 10:41:06] "POST /accounts/user_profile/ HTTP/1.1" 200 233
[02/Nov/2022 10:41:06] "POST /accounts/user_profile/ HTTP/1.1" 200 233
[02/Nov/2022 10:41:07] "POST /accounts/user_profile/ HTTP/1.1" 200 233
console output of stage
2/Nov/2022 10:42:02,390] - Broken pipe from ('192.168.148.1', 60162)
[02/Nov/2022 10:42:02,391] - Broken pipe from ('192.168.148.1', 54466)
[02/Nov/2022 10:42:07,392] - Broken pipe from ('192.168.148.1', 56644)
log.py-line:224 - log_response() -WARNING 2022-11-02 10:42:46,899 Forbidden: /accounts/api/login/
[02/Nov/2022 10:42:46] "GET /accounts/api/login/ HTTP/1.1" 403 3764
log.py-line:224 - log_response() -WARNING 2022-11-02 10:42:49,687 Forbidden: /accounts/api/login/
[02/Nov/2022 10:42:49] "GET /accounts/api/login/ HTTP/1.1" 403 3764
What may be the causes ?