# DRF login security

**URL:** <https://forum.djangoproject.com/t/drf-login-security/9456>\
**Category:** Using Django\
**Created:** [August 29, 2021, 6:01pm UTC](https://forum.djangoproject.com/t/drf-login-security/9456 "2021-08-29T18:01:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nanush](https://avatars.discourse-cdn.com/v4/letter/n/0ea827/32.png) [@Nanush](https://forum.djangoproject.com/u/Nanush)\
**Post date:** [August 29, 2021, 6:01pm UTC](https://forum.djangoproject.com/t/drf-login-security/9456/1 "2021-08-29T18:01:01Z")

</div>

I am developing an API that will be consumed by a mobile application.  
The DRF’s documentation ([Authentication - Django REST framework](https://www.django-rest-framework.org/api-guide/authentication/#sessionauthentication)) says: _“ **Warning** : Always use Django’s standard login view when creating login pages. This will ensure your login views are properly protected.”_

I have the following in a custom view:

```python
# ...
user = authenticate(username=data['username'], password=data['password'])
if user:
    login(request, user)
else:
    # ...

```

Is this insecure?

---

<div class="post-metadata">

**Author:** ![CodenameTim](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/codenametim/32/31507_2.png) [@CodenameTim](https://forum.djangoproject.com/u/CodenameTim)\
**Post date:** [August 30, 2021, 6:46pm UTC](https://forum.djangoproject.com/t/drf-login-security/9456/2 "2021-08-30T18:46:49Z")

</div>

Hi Nanush,

The context around that message is that you should be using [CSRF validation](https://docs.djangoproject.com/en/3.2/ref/csrf/#ajax) when using session authentication via AJAX.