edx-drf-extensions
edX extensions of Django REST Framework
Decision gist · record as of 2026-08-14
Yes, if you are building a Django REST API that needs JWT authentication and CSRF token handling integrated with the Open edX ecosystem. The library is actively maintained, has no known vulnerabilities, and provides well-documented authentication utilities. No, if you are building a standalone Django REST API unrelated to Open edX—the package may be tightly coupled to Open edX conventions.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Django 4.2 or later and Python 3.11 or later (dropped support for earlier versions in recent releases).
- Low friction installation with a pure-Python wheel.
- Actively maintained with recent Django 5.2 support added in version 10.6.0 (released 2025-04-04).
License · maintenance · safety
Apache 2.0 (permissive) — Apache 2.0 permissive license allows commercial and private use with minimal restrictions. No copyleft obligations or proprietary concerns.
last release 2025-04-04 (497 days) · last repo commit 2026-08-10 · 18 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 89,391 downloads/mo, #13,662 on PyPI
Alternatives
Verify before relying
pip install edx-drf-extensions
from djangorestframework import serializers
from Django import middleware
# Add to Django MIDDLEWARE and INSTALLED_APPS
MIDDLEWARE = [..., 'JwtAuthCookieMiddleware']
INSTALLED_APPS = [..., 'csrf.apps.CsrfAppConfig']- Whether the package is suitable for non-Open edX Django projects or is tightly coupled to Open edX infrastructure.
- Performance impact of email matching check when ENABLE_JWT_AND_LMS_USER_EMAIL_MATCH toggle is enabled.
- Specific JWT signature verification behavior and fallback scenarios in cookie validation.
What it is and what it does
edx-drf-extensions is a library of shared API utilities built on top of Django and djangorestframework, providing JWT authentication, CSRF token endpoints, and cross-cutting concerns for multiple applications. It handles JWT cookie validation with fallback to session authentication, email matching verification between JWT and user records, and exposes a CSRF API endpoint for frontend applications making state-changing requests to Django services with CSRF middleware enabled.
The library depends on Django, djangorestframework, drf-jwt, pyjwt, django-waffle, edx-django-utils, edx-opaque-keys, requests, and semantic_version. It is actively maintained with a stable release history since 2016, recent releases adding support for Django 5.2 and Python 3.12, and dropping support for older versions. The codebase includes detailed changelog documentation of breaking changes and feature toggles for gradual rollout.
Use it for
- Add JWT authentication to a Django REST API service that validates tokens from an identity provider.
- Expose a CSRF token endpoint in a Django service for frontend applications to retrieve tokens for state-changing requests.
- Implement forgiving JWT cookie authentication that falls back to session authentication when JWT validation fails.
- Verify that JWT user identity matches the session user identity to prevent authentication bypass in multi-service deployments.
- Enable email matching validation between JWT claims and user records in LMS services.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you are building a Django REST API that needs JWT authentication and CSRF token handling integrated with the Open edX ecosystem.
The library is actively maintained, has no known vulnerabilities, and provides well-documented authentication utilities. No, if you are building a standalone Django REST API unrelated to Open edX—the package may be tightly coupled to Open edX conventions.
Install
edx-drf-extensions on PyPI
Before you install
Low friction installation with a pure-Python wheel. Actively maintained with recent Django 5.2 support added in version 10.6.0 (released 2025-04-04). Nine runtime dependencies are all standard Django and authentication libraries.
Requires Django 4.2 or later and Python 3.11 or later (dropped support for earlier versions in recent releases).
License in practice
Apache 2.0 permissive license allows commercial and private use with minimal restrictions. No copyleft obligations or proprietary concerns.
Quickstart
pip install edx-drf-extensions
from djangorestframework import serializers
from Django import middleware
# Add to Django MIDDLEWARE and INSTALLED_APPS
MIDDLEWARE = [..., 'JwtAuthCookieMiddleware']
INSTALLED_APPS = [..., 'csrf.apps.CsrfAppConfig']Verify before relying
- Whether the package is suitable for non-Open edX Django projects or is tightly coupled to Open edX infrastructure.
- Performance impact of email matching check when ENABLE_JWT_AND_LMS_USER_EMAIL_MATCH toggle is enabled.
- Specific JWT signature verification behavior and fallback scenarios in cookie validation.
Package facts
| License | Apache 2.0 permissive |
| Python support | Not specified |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 9 packagesDjangodjango-waffledjangorestframeworkdrf-jwtedx-django-utilsedx-opaque-keyspyjwtrequestssemantic_version |
| Maintenance | Actively maintained 497 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 89,391 / month, #13,662 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableEnvironment :: Web EnvironmentFramework :: DjangoFramework :: Django :: 4.2Framework :: Django :: 5.2Intended Audience :: DevelopersLicense :: OSI Approved :: Apache Software LicenseOperating System :: OS IndependentProgramming Language :: Python :: 3Programming Language :: Python :: 3.11 |
Evidence: edx_drf_extensions-10.6.0-py2.py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “csrf token endpoint django”
- edx-drf-extensionsProvides JWT authentication, CSRF token endpoints, and cross-cutting…
- django-webtestIntegrates WebTest with Django's testing framework to enable…
- fastapi-csrf-protectAdds stateless CSRF protection to FastAPI applications using the…
Give your agent the search over MCP, or paste the wish link into any chat.
More WWW/HTTP packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
h11 is a pure-Python HTTP/1.1 protocol implementation that handles parsing and serializing HTTP messages without any built-in I/O, letting you integrate it with any network layer you choose.
HTTPX is a fully featured HTTP client library for Python that provides both sync and async APIs, with support for HTTP/1.1 and HTTP/2, plus an integrated command-line client.
Install it if you are building new projects or modernizing existing ones that rely on HTTP.
A minimal low-level HTTP client library that sends HTTP requests with thread-safe and task-safe connection pooling, supporting HTTP/1.1, HTTP/2, proxies, and both sync and async interfaces.
aiohttp is an async HTTP client and server framework built on asyncio, supporting both WebSockets and middleware-based routing for building concurrent web applications.
Install it if you need async HTTP client or server capabilities in asyncio-based applications.
See also edx-rest-api-client · drf-jwt · zi-api-auth-client · djangorestframework-simplejwt · openedx-events · edx-django-utils · edx-enterprise · dj-rest-auth · edx-ccx-keys · edx-django-release-util