I have a Django Rest/ Vue.js application. I was using basic Django authentication but since it is a Single Page Application, I switched to Token Authentication so I can manage login/logout/register through an endpoint and get a more consistent application.
Overall is working fine but my main problem is that I made some permissions and override some viewsets. I have to disable them in order to have my app to work with token authentication:
My permissions:
from rest_framework import permissions
class IsOwnReviewOrReadOnly(permissions.BasePermission):
def has_object_permission(self, request, view, obj):
if request.method in permissions.SAFE_METHODS:
return True
return obj.restaurant_review.review_author == request.user
class IsAuthorOrReadOnly(permissions.BasePermission):
def has_object_permission(self, request, view, obj):
if request.method in permissions.SAFE_METHODS:
return True
return obj.review_author == request.user
And my viewset:
class RestaurantReviewViewset(viewsets.ModelViewSet):
queryset = models.RestaurantReview.objects.all().order_by("-created_at")
def get_serializer_class(self):
if self.request.method == 'GET':
return serializers.RestaurantReviewGETSerializer
else:
return serializers.RestaurantReviewSerializer
permission_classes = [IsAuthenticatedOrReadOnly,IsAuthorOrReadOnly]
def perform_create(self, serializer):
serializer.save(review_author=self.request.user)
So my guess is that Django can't find request.user, is it related to my new authentication? Can Token Authentication provide it?