Next let's test our authentication token using the mod headers chrome extension
now you can see from our previous video that we were given this token string
when we logged in with our users username and password now the way that
the token authentication works is every single request that's made to the API
has a HTTP header what we do is we add the token to the authorization
header for the requests that we wish to authenticate so when you make a request
like a HTTP GET HTTP put patch or post with that request you can provide a
header and in our header we're going to add a key called authorization and then
we're going to pass in this token with the request and then when Django rest
framework receives that request it can check whether this token exists in the
database and retrieve the appropriate user for this token so we're
going to use the mod header chrome extension to set our header and check
that we can manage our profile when we're authenticated with it so if you
didn't already install the mod header chrome extension then go ahead and make
sure you have that installed as you're going to need it in order to test the
API in this video
so let's copy the string that we were given from our token
so we're going to copy that to the clipboard and then we're going to open up
the mod header chrome extension and we're going to type in the request headers
name we're going to type authorization and you can see that it gives it a drop-down
here and then the way you pass in the token is you write token with a capital
T and then space and then you paste the token so the Django rest framework knows
to remove this token part from the prefix here and then just take this as
the token so this is the standard convention for providing a token in the
authorization header for the Django rest framework okay so that's all you need to
do to authenticate the requests now let's go
ahead and test it make sure you have this box checked here and then head over
to API slash profile and you can see that we returned the list of profiles
now we authenticated as the mark@londonappdev.com profile so take the
ID for whichever profile you authenticated with and put that ID in
the URL here so I'm going to test with ID one so I'm going to put profile
forward slash one and hit enter you can see that now we can modify this profile
because we've authenticated as that user so we can go ahead and
change the name let's change the name to my full name here and then let's change
the password I'm going to change it to password one two three just the same
password that it is now hit put and you can see that it returned the updated
object with a new name so if we go back to the profiles list by removing the ID
you can see that the name has been updated here okay so what happens if we
go to another profile that we're not authenticated with let's go to profile
two you can see that we're unable to modify this profile because we haven't
authenticated with the correct user so let's go back to profile one and then if
you wanted to disable the authentication while you're browsing the API then you
can simply open up the mod header chrome extension and uncheck this box here and
then this header will no longer be sent with the HTTP requests so when we
uncheck it and then we refresh the page you can see that the option to modify
this profile disappeared because we're no longer authenticated okay so a couple
of things to note about the mod header Chrome extension if you're browsing
other websites when you have the authorization token enabled then it may
conflict with those websites so just make sure that you disable the authorization
token whenever you're not testing the API as it can often
creates some unexpected side effects on websites like Google and Google Drive
and things like that
okay another thing to note is that this isn't how you would
use this token in real life when you actually use the API you would pass the
token in into whichever client library you're using so if you're using
JavaScript then you may use a library like the fetch library if we're using
Python then you may use a library like the request library and these HTTP libraries
all allow you to add custom header tokens to your requests we're just using
this mod header chrome extension in order to test our API in the browser
okay so it appears that our API authentication is working correctly
let's go over to the terminal and let's commit our changes to git and then push
it up to github so head over to the terminal git bash window and then type
git add dot git commit - am we'll type the message added log in API and then
we'll do git push origin to push these changes to github