title: Using Django Session Framework with a Token instead of a Cookie?
body: <p>I have a DRF API with protected endpoints that returns filtered data depending on what a user has permission to access.</p>
  
  <p>I have a separate Django OAuth2 provider which contains the user models and the values necessary to determine what the user has permission to access.</p>
  
  <p>The user should be able to authenticate via a login endpoint on the DRF API. The API in turn gets a token from the Oauth2 provider on behalf of the user, and makes a few calls to get a list of resources the user is allowed to access.</p>
  
  <p>Ideally the DRF API would then generate a token and return it to the user. Whenever the user makes a subsequent request (after login) using the token, the API would be able to filter results via the values returned by calls to the Oauth provider.</p>
  
  <p>The question is how to store this information. This feels similar to storing data in an anonymous user session, but using a request header instead of a cookie. I've considered rolling a customized version of <a href="https://github.com/django/django/blob/master/django/contrib/sessions/middleware.py" rel="noreferrer">django.contrib.sessions.middleware.SessionMiddleware</a>, but I'd prefer to use an established method instead of writing custom code, as this seems like it should not be a unique problem.</p>
  
  <p>To reiterate: Is it possible to create an anonymous user session, store information it it, and retrieve the session via a request header instead of a cookie?</p>