Where in Django is JWT token validation performed?

In Django, JWT token validation usually occurs at the middleware level or in custom authentication classes when using Django REST Framework (DRF). For example, when using the djangorestframework-simplejwt library, token verification is handled in the JWTAuthentication authentication class, which is invoked during request processing to check the signature, expiration, and payload of the token.

Example of using a custom authentication class in DRF:

from rest_framework_simplejwt.authentication import JWTAuthentication

class CustomJWTAuthentication(JWTAuthentication):
    def authenticate(self, request):
        # Token validation occurs here
        return super().authenticate(request)

Thus, JWT validation happens at the moment of user authentication, before reaching the application's business logic.