title: Django-rest-framework and django-rest-framework-jwt APIViews and validation Authorization headers
body: <p>I'm using DRF and DRF-jwt to secure my APIs. Currently I have some CBV written like this</p>
  
  <pre><code>class Organization(APIView):
      permission_classes = (IsAuthenticated,)
      @method_decorator(csrf_exempt, name='dispatch')
      class OfficeVisitsOverview(APIView):
          def post(self, request, *args, **kwargs):
              cursor = connection.cursor()
              (before, today) = getDateRange()
              cursor.execute("SELECT format(COUNT(*), 'N0') \
                              FROM Medi_OfficeVisit \
                              WHERE ( cast(VisitDate as date) BETWEEN '{0}' AND '{1}' ) \
                      ".format(before, today))
              data = dictfetchall(cursor)
              connection.close()
              return JsonResponse({"numberOfOVs": data[0][""]})
  </code></pre>
  
  <p>From my understanding the APIView and the permission class IsAuthenticated makes sure that theres an Authorization token being sent with the request header. How can you be sure that no one has modified the JWT? How do i know that the Secret_Token in my Django app is being used every time to decode/encode/verify/validate the JWT that is being received/sent with every request? Is this enough security for my APIs to be opened to the public?</p>