Here is where I've landed after two days of hacking. I welcome any feedback or criticism. If you identify a fundamental functional or security flaw with this approach, I'll paypal you enough cash for a pound of coffee or six-pack of beer.
I have selected Django as my 'modern web stack' for a foundational platform. I'll be leveraging it for security, account, session, and password management. I eagerly defer security-sensitive functionality to Django (i.e. following convention wherever possible). I do not shirk responsibility for security, but I believe informed consumption of an industry-vetted framework is inherently more secure than rolling your own. I selected Django primarily based on familiarity with and preference for Python, plus the framework's maturity.
Out of the box, Django has great support for account management and authentication. Of particular value is the great Django admin interface which lets a superuser reset passwords, disable accounts, etc. This is a huge value imho.
To support registration and account lifecycle management (password reset, etc), I went with the django-registration module:
This appears to be a very mature and vetted library with great documentation. It does not include basic form templates but I found a good set here which I customized:
This got me up and running with a full account management solution for web-usage, but (as mentioned above) I need an API-based solution for a mobile app. I don't want to persist the user password locally on the phone and I'd prefer to avoid managing session cookies in my API calls (a token approach is superior imho). I discovered this module:
Which works great. The only thing missing at this point was an API for programmatically registering new accounts from the native mobile application. I coded this myself.
So long story short, I have the following working (as vanilla-Django as possible):
- full account auth and lifecycle management from Django Auth
- full account web registration from django-registration
- some primitive, but functional, account UI templates from django-registration-defaults
- token-based security for mobile API calls via django-tokenapi
- a special one-off API for registering new accounts inside the mobile app
Seems to be working...