title: Django + Auth0 JWT authentication refusing to decode
body: <p>I am trying to implement Auth0 JWT-based authentication in my Django REST API using the django-rest-framework. I know that there is a JWT library available for the REST framework, and I have tried using it because the official Auth0 twitter account mentioned that it should work well with auth0 + Django.</p>
  
  <p><strong>EDIT</strong>: I am using <a href="https://auth0.com/docs/server-apis/python">the official auth0 python api guide</a> for this code. It's written for flask, but I figured I could just port it to Django seeing as they work similarly.</p>
  
  <p>Now, that didn't work out how I wanted to, so I am trying to write my own <code>login_required</code> decorater for a view. The code I have here is as following:</p>
  
  <pre><code>def auth_required(f):
  
      def wrap(request, *args, **kwargs):
          auth = request.META.get('HTTP_AUTHORIZATION', None)
  
          if not auth:
              return authenticate({'code': 'authorization_header_missing', 'description': 'Authorization header is expected'})
  
          parts = auth.split()
  
          if parts[0].lower() != 'bearer':
              return authenticate({'code': 'invalid_header', 'description':     'Authorization header must start with Bearer'})
          elif len(parts) == 1:
              return authenticate({'code': 'invalid_header', 'description':     'Token not found'})
          elif len(parts) &gt; 2:
              return authenticate({'code': 'invalid_header', 'description': 'Authorization header must be Bearer + \s + token'})
  
          token = parts[1]
          try:
              payload = jwt.decode(
                  token,
                  base64.b64decode(SECRET.replace("_","/").replace("-","+")),
                  audience=CLIENT_ID,
              )
          except jwt.ExpiredSignature:
              return authenticate({'code': 'token_expired', 'description': 'token is expired'})
          except jwt.InvalidAudienceError:
              return authenticate({'code': 'invalid_audience', 'description': 'incorrect audience, expected: ' + CLIENT_ID})
          except jwt.DecodeError:
              return authenticate({'code': 'token_invalid_signature', 'description': 'token signature is invalid'})
  
  
          return f(request, *args, **kwargs)
  
      wrap.__doc__=f.__doc__
      wrap.__name__=f.__name__
  
      return wrap
  </code></pre>
  
  <p>Now, the <code>authenticate()</code> is basically my custom implementation for <code>Jsonify()</code> which is used in the documentation of Auth0 for Python API's. I have verified that this works, so that's not a problem.</p>
  
  <p><code>SECRET</code> is my Auth0 secret, encoded in base64 (any other keys failed to decode)<br>
  <code>CLIENT_ID</code> is my Auth0 client ID which is used as the audience, according to the Auth0 documentation.</p>
  
  <p>I am using the Angular seed project on the frontend-side, and I have verified that the token indeed gets sent with the request, and I have verified that it's the exact same token that gets stored in the <code>token</code> variable on the backend.</p>
  
  <p>When <code>jwt.decode()</code> is called, it will trigger the <code>jwt.DecodeError</code> every time, and I have been spending countless hours trying to fix this, but I am absolutely stunned as to why this is <em>not</em> working. I have tried setting the JWT options to false, specifically the verify signature one. This worked, but I assume that it's <em>unsafe</em> to disable the verifying of the JWT signature.</p>
  
  <p>I cannot figure out why this is failing me, I have tried this same code without it being in a decorator and it does the same thing. The view which is decorated is just an empty view which returns an OK HttpResponse.</p>
  
  <p>Tldr; Using Django-REST + Auth0 JWT -- <code>jwt.decode()</code> will not work no matter what I do.</p>
  
  <p><strong>EDIT2</strong>: It's worth mentioning I am <code>corsheaders</code> for django-rest which allows me to make cross-domain requests. I have also followed the tip at the bottom of the Python API guide from Auth0 to uninstall and reinstall the JWT library, but this did nothing for me.</p>
  
  <p>Am I overlooking something, is this implementation plain unsecure or do you have any better way to implement Auth0 with Django? Please let me know, this problem is causing me nightmares.</p>