django - Do not require authentication for GET requests from browser -
this question closely related do not require authentication options requests
my settings.py
rest_framework = { 'unicode_json': true, 'non_field_errors_key': '__all__', 'default_authentication_classes': ( 'rest_framework.authentication.tokenauthentication', ), 'default_permission_classes': ( 'platformt_core.something.permissions.djangoobjectpermissionsoroptions', ), 'default_renderer_classes': ( 'rest_framework.renderers.jsonrenderer', ), 'allowed_versions': ['v1'], 'default_versioning_class': 'rest_framework.versioning.namespaceversioning', 'test_request_default_format': 'json', 'test_request_renderer_classes': ( 'rest_framework.renderers.jsonrenderer', ) }
platformt_core/something/permissions.py
from rest_framework.permissions import djangoobjectpermissions options_method = 'options' class djangoobjectpermissionsoroptions(djangoobjectpermissions): def has_permission(self, request, view): if request.method == options_method: return true else: return super(djangoobjectpermissions, self).has_permission(request, view)
when request browser:
get /api/passenger/v1/order/ http/1.1 host: 127.0.0.1:8000 connection: keep-alive cache-control: max-age=0 accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 user-agent: mozilla/5.0 (x11; linux x86_64) applewebkit/537.36 (khtml, gecko) chrome/42.0.2311.135 safari/537.36 accept-encoding: gzip, deflate, sdch accept-language: en-us,en;q=0.8 cookie: csrftoken=3xytvl8oh2pjxcss1ufi9tizmotc5pix
i expect neat "self describing apis" described @ http://www.django-rest-framework.org/topics/documenting-your-api/
but instead get:
http/1.0 401 unauthorized date: wed, 08 jul 2015 20:45:23 gmt server: wsgiserver/0.1 python/2.7.6 content-type: application/json;q=0.8; charset=utf-8 www-authenticate: token allow: post, options {"detail":"authentication credentials not provided."}
is there neat way achieve that? mean have browseable api, api requests should still secured authentication.
can't use?
'default_permission_classes': ('rest_framework.permissions.isauthenticatedorreadonly',)
this allow read-only access unauthenticated users.
Comments
Post a Comment