---
id: edx-drf-extensions
version: "10.6.0"
license: Apache 2.0
license_treatment: permissive
maintenance: active
---

# edx-drf-extensions — edX extensions of Django REST Framework

License: permissive · Maintenance: active · Downloads: 89.4K/mo

## What it is and what it does

edx-drf-extensions is a library of shared API utilities built on top of Django and djangorestframework, providing JWT authentication, CSRF token endpoints, and cross-cutting concerns for multiple applications. It handles JWT cookie validation with fallback to session authentication, email matching verification between JWT and user records, and exposes a CSRF API endpoint for frontend applications making state-changing requests to Django services with CSRF middleware enabled.

The library depends on Django, djangorestframework, drf-jwt, pyjwt, django-waffle, edx-django-utils, edx-opaque-keys, requests, and semantic_version. It is actively maintained with a stable release history since 2016, recent releases adding support for Django 5.2 and Python 3.12, and dropping support for older versions. The codebase includes detailed changelog documentation of breaking changes and feature toggles for gradual rollout.

Use it for:

- Add JWT authentication to a Django REST API service that validates tokens from an identity provider.
- Expose a CSRF token endpoint in a Django service for frontend applications to retrieve tokens for state-changing requests.
- Implement forgiving JWT cookie authentication that falls back to session authentication when JWT validation fails.
- Verify that JWT user identity matches the session user identity to prevent authentication bypass in multi-service deployments.
- Enable email matching validation between JWT claims and user records in LMS services.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides JWT authentication, CSRF token endpoints, and cross-cutting API concerns for Django REST Framework applications.

Yes, if you are building a Django REST API that needs JWT authentication and CSRF token handling integrated with the Open edX ecosystem. The library is actively maintained, has no known vulnerabilities, and provides well-documented authentication utilities. No, if you are building a standalone Django REST API unrelated to Open edX—the package may be tightly coupled to Open edX conventions.

## Install

pip install edx-drf-extensions
uv add edx-drf-extensions
poetry add edx-drf-extensions

## Installing edx-drf-extensions

Before you install: Low friction installation with a pure-Python wheel. Actively maintained with recent Django 5.2 support added in version 10.6.0 (released 2025-04-04). Nine runtime dependencies are all standard Django and authentication libraries.

License in practice: Apache 2.0 permissive license allows commercial and private use with minimal restrictions. No copyleft obligations or proprietary concerns.

Quickstart:

pip install edx-drf-extensions

from djangorestframework import serializers
from Django import middleware

# Add to Django MIDDLEWARE and INSTALLED_APPS
MIDDLEWARE = [..., 'JwtAuthCookieMiddleware']
INSTALLED_APPS = [..., 'csrf.apps.CsrfAppConfig']

Requires Django 4.2 or later and Python 3.11 or later (dropped support for earlier versions in recent releases).

Verify before relying:

- Whether the package is suitable for non-Open edX Django projects or is tightly coupled to Open edX infrastructure.
- Performance impact of email matching check when ENABLE_JWT_AND_LMS_USER_EMAIL_MATCH toggle is enabled.
- Specific JWT signature verification behavior and fallback scenarios in cookie validation.

## Package facts

- License: Apache 2.0 (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: active
- Downloads: 89.4K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

django rest framework jwt authentication, csrf token endpoint django, drf jwt middleware, django api extensions, jwt cookie authentication, jwt-auth, django-rest-framework

[View on SkillFed](https://skillfed.io/packages/edx-drf-extensions) · [View on PyPI](https://pypi.org/project/edx-drf-extensions/)