How to encrypt responses in DRF?

Question

I want to encrypt my DRF project APIs responses Is there a way to encrypt large responses so that I only have access to the data on the front end side? I want to encrypt all responses.

Answer 1

Yes it is possible and I had applied it myself. You can do it using AES256 (Advanced encryption standard 256) applied directly into the serializer.

Basically the encryption will be relying on the django's secrete key to encrypt and decrypt.

Therefore, there will be two functions encrypt() and decrypt() where you will apply for each field that you need to send them encrypted into the database. As well as to decrypt when the endpoint hit the GET request.

You can get these function example and implementation here.

Example:

from rest_framework import serializers
from django.conf import settings
from aesencryption import AESCipher

aes = AESCipher(settings.SECRET_KEY[:16], 32)


class MyModelSerializer(serializers.ModelSerializer):
    class Meta:
        model = MyModel
        fields = ['name', 'address']

    def create(self, validated_data):
        # Here the data will be inserted into the db encrypted.
        validated_data['name'] = aes.encrypt(validated_data['name'])
        validated_data['address'] = aes.encrypt(validated_data['address'])
        return MyModel.objects.create(**validated_data)

    def to_representation(self, instance):
        # Here you will decrypt the data from the db.
        return {
            'name': aes.decrypt(instance.name),
            'address': aes.decrypt(instance.address)
        }

Warning: Be careful when changing the secrete_key. If you lose it there is no way you can get the data back.