Django Rest Framework behind HTTP Basic Authentication

Question

If my webservice (powered by Django Rest Framework, v2.3.8) is inside a location protected by Nginx's HTTP Basic Authentication, like so:

location / {
            auth_basic           "Restricted access";
            auth_basic_user_file /path/to/htpasswd;

            uwsgi_pass django;
            include /etc/uwsgi/config/uwsgi_params;
    }

Then, when a user authenticate and tries to access the API, the following response is obtained for all views:

{"detail": "Invalid username/password"}

Does Django Rest Framework pick up the HTTP Authorization header (meant for Nginx) even though the view requires no authentication? If so, how should I go about this?

Any help would be greatly appreciated.

score 8 · Answer 1 · edited Oct 20 '15 at 10:17

8

By default, Django Rest Framework has two authentication classes, see here.

REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
    'rest_framework.authentication.SessionAuthentication',
    'rest_framework.authentication.BasicAuthentication'
)}

You can disable the rest framework authentication if you don't need it.

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': ()
}

Or you can remove only BasicAuthentication as it will work in your case.

REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
    'rest_framework.authentication.SessionAuthentication'
)}

edited Oct 20 '15 at 10:17

chhantyal

10,570
6
45
71

answered Dec 18 '13 at 16:19

ottojiang

91
3

for security reasons dont disallow the default security settings – panchicore Apr 04 '14 at 02:39
This answer works. You can tune application for security when you need security. – Fabio Montefuscolo Apr 07 '14 at 14:11

score 2 · Answer 2 · edited May 23 '17 at 11:48

2

As noted in another post, you must add a comma next to the authentication class or it can throw a TypeError.

'DEFAULT_PERMISSION_CLASSES': (
    'rest_framework.authentication.SessionAuthentication', #comma added here
)

Source: https://stackoverflow.com/a/22697034/5687330

edited May 23 '17 at 11:48

Community

1
1

answered Nov 02 '16 at 14:32

Marc Aubin

31
2

Django Rest Framework behind HTTP Basic Authentication

2 Answers2

Linked