title: Django internal API Client/Server Authentication or not?
body: <p>I have a django project, in which i expose a few api endpoints (api endpoint = answers to get/post, returns json response, correct me if im wrong in my definition). Those endpoints are used by me on front end, like update counts or get updated content, or a myriad other things. I handle the representation logic on server side, in templates, and in some cases send a rendered to string template to the client.</p>
  
  <p>So here are the questions im trying to answer:</p>
  
  <ol>
  <li>Do i need to have some kind of authentication between the clients and the server?</li>
  <li>Is django cross origin protection enough?</li>
  <li>Where, in this picture, fit such packages like <a href="https://github.com/evonove/django-oauth-toolkit">django-oauth-toolkit</a>? And <a href="http://django-rest-framework.org/">django-rest-framework</a>?</li>
  <li>if i don't add any authentication between clients and server, am i leaving my server open for attacks?</li>
  </ol>
  
  <p>Furthermore, what goes for server-to-server connection? Both servers under my control. </p>