The most obvious solution here will allow session based authentication which is considered a bad practice in Django REST Framework somehow.

So I have worked out a simple way to play the token in a cookie and then try to read it from the cookie if it is absent in the headers (like in the case of moving between 2 different domains that consume our API).

The request returns the following data in the 'Cookies' sections under 'Network'

However, under 'Application' I cannot see the cookie at all

This is the code I have written

middleware.py

class WhiteLabelSessionMiddleware(MiddlewareMixin):
    def process_request(self, request):
        request_token = request.META.get('HTTP_AUTHORIZATION')
        cookie_token = request.COOKIES.get(settings.WHITE_LABEL_COOKIE_NAME)

        if cookie_token:
            print(cookie_token)

        if cookie_token and not request_token:
            # must be assigned by reference
            request.request.META['HTTP_AUTHORIZATION'] = cookie_token

    def process_response(self, request, response):
        request_token = request.META.get('HTTP_AUTHORIZATION')
        cookie_token = request.COOKIES.get(settings.WHITE_LABEL_COOKIE_NAME)

        if not cookie_token and request_token:
            response.set_cookie(settings.WHITE_LABEL_COOKIE_NAME,
                                request_token,
                                max_age=settings.SESSION_COOKIE_AGE,
                                expires=settings.SESSION_COOKIE_AGE,
                                domain=settings.SESSION_COOKIE_DOMAIN,
                                secure=settings.SESSION_COOKIE_SECURE)

        return response

settings.py

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.locale.LocaleMiddleware',
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'session_security.middleware.SessionSecurityMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    'core.middleware.WhiteLabelSessionMiddleware',
    'core.middleware.TimezoneMiddleware',
    'core.middleware.LastSeenMiddleware',
    'social_django.middleware.SocialAuthExceptionMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django_otp.middleware.OTPMiddleware',
    'referrals.middleware.ReferralMiddleWare',
    'audit_log.middleware.UserLoggingMiddleware',
    'axes.middleware.AxesMiddleware',
]

WHITE_LABEL_COOKIE_NAME = 'nex_token'
SESSION_COOKIE_AGE = 60 * 60 * 24 * 30 * 12
_COOKIE_EXPIRES = datetime.datetime.utcnow() + \
                  datetime.timedelta(seconds=SESSION_COOKIE_AGE)
SESSION_COOKIE_EXPIRES = \
    datetime.datetime.strftime(_COOKIE_EXPIRES,
                               "%a, %d-%b-%Y %H:%M:%S GMT")
SESSION_COOKIE_DOMAIN = '.n.exchange'
SESSION_COOKIE_SECURE = True
SESSION_ENGINE = 'django.contrib.sessions.backends.cached_db'

settings_dev.py

SESSION_COOKIE_DOMAIN = 'localhost'
SESSION_COOKIE_SECURE = False
WHITE_LABEL_COOKIE_NAME = 'nex_token_dev'

Am I missing something here?