Django Auth System vs. REST Framework Authentication

Django's built-in authentication system is indeed robust, but REST frameworks like Django REST Framework (DRF) and Django Ninja implement their own authentication layers for specific reasons related to the nature of REST APIs.

Why REST Frameworks Need Custom Auth

Django's authentication system was primarily designed for traditional web applications where:

• Users interact through browser sessions
• Authentication is typically handled through cookies and sessions
• The auth flow is tightly integrated with Django's view system

REST APIs have different requirements:

1. They often need to be stateless
2. They commonly use token-based authentication rather than sessions
3. They need to support various authentication schemes (API keys, JWT, OAuth, etc.)
4. They must work well with non-browser clients

What Django's Auth System Provides vs. What REST Needs

Django's authentication system provides:

• User models and management
• Password hashing
• Permissions and groups
• Authentication backends

However, Django's default auth system doesn't directly address:

• Token-based authentication mechanisms needed for REST APIs
• Stateless authentication flows
• Easy integration with third-party OAuth providers
• Specialized handling for API requests

The Pluggable Backend System

As mentioned in the documentation:

The Django authentication system lets you plug in other authentication sources. You can override Django's default database-based scheme, or you can use the default system in tandem with other systems.

REST frameworks leverage this extensibility but implement authentication at a different layer that's more appropriate for API requests.

Conclusion

REST frameworks aren't replacing Django's auth system - they're building on top of it. They use Django's User model, permissions system, and backend architecture while adding specialized authentication mechanisms that are better suited for REST APIs.

Libraries like djangorestframework-simplejwt and django-ninja-simplejwt provide implementations of specific authentication schemes (JWT in this case) that integrate with their respective frameworks' authentication layers.

This approach allows developers to use the most appropriate authentication method for their API needs while still leveraging Django's core authentication infrastructure.