Rest framework Tokenauthentication bypassed?

user_13528380 0
Viewed 55

I am new to Rest framework with Django and am currently confused about token authentication.

settings.py

    INSTALLED_APPS = [
    ...
        'rest_framework',
        'rest_framework.authtoken',
        'djoser',
        'corsheaders', 
    ...
    ]

    REST_FRAMEWORK = {
        'DEFAULT_AUTHENTICATION_CLASSES': [
            'rest_framework.authentication.TokenAuthentication', 
            ]
}

views.py

from rest_framework.decorators import permission_classes
from rest_framework.permissions import IsAdminUser 

@permission_classes([IsAdminUser])        
def users(request):
    if request.method == 'GET':
        userProfile_requests = UserProfile.objects.all()
        requests_serializer = UserProfileSerializer(userProfile_requests, many=True)
        return JsonResponse(requests_serializer.data, safe=False)

Now in the terminal I type, without any token:

 http GET localhost:8000/users/

And I don't get an access deny... where is my mistake?

If I make a print(request.user), I get AnonymousUser...

django-rest-framework
2 Answers

Add this in your settings.py

REST_FRAMEWORK = {
    ......
    ......

    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.IsAuthenticated',
    ]
 }
user_29712150

I thought, that the @api_view(['GET']) was for a special case. It is not. 

@api_view(['GET'])       
@permission_classes([IsAdminUser]) 

def users(request):
    if request.method == 'GET':
user_135283800
Related