Django REST Framework: using TokenAuthentication with browsable API

Question

I'm following the DRF docs to setup TokenAuthentication, and can't get it working with the browsable API. I believe I've added the proper lines in settings.py:

REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
    'rest_framework.authentication.TokenAuthentication',
    ),

INSTALLED_APPS = (
   ...
'rest_framework',
'rest_framework.authtoken',
   ...

As well as generated tokens for existing users with the code snippet from the docs. I can see tokens for each user if I query the authtoken_token table, so I know they exist.

Everytime I try to log in to the browsable API, I get the following content returned:

HTTP 401 Unauthorized
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept
WWW-Authenticate: Token

{
"detail": "Authentication credentials were not provided."
}

So it appears to be attempting Token authentication, but this message is a little odd. When I enter an incorrect password, I get the 'enter a correct password' message on the login form. When I enter the correct password, it appears to login, but takes me to the API root with the above message, and displays "Log In" on the top menu, rather than the username.

Could this be related to my custom user model somehow? Or could it be due to the fact that I'm currently developing with the dev server, which doesn't support https- the DRF docs mention needing HTTPS with TokenAuthentication, though I wasn't sure if that was a best practice or actually required.

ilse2005 · Accepted Answer · 2016-02-24 11:49:27Z

37

You can't use the browsable api with TokenAuthentication. You have to add SessionAuthtication to your settings (http://www.django-rest-framework.org/api-guide/authentication/#sessionauthentication):

REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
    'rest_framework.authentication.TokenAuthentication',
    'rest_framework.authentication.SessionAuthentication',
),

answered Feb 24, 2016 at 11:49

ilse2005

11.5k5 gold badges57 silver badges75 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Kutay Demireren Over a year ago

If I add this auth, it does not mean that anyone who make request to my server will access just with username and password (as without token auth), does it? It just works for websites I guess, but I wanted to be sure.

Jadav Bheda Over a year ago

Even 'rest_framework.authentication.BasicAuthentication' would serve the purpose. I prefer it because ideally SessionAuthentication should be only used when your server and client both run in same context like django templates. @KutayDemireren - yes anyone with username/password and proper permission will have access to the APIs. But its upto you to publish API endpoint or not.

Aaron Over a year ago

For other newbies that might be confused. Basically my understanding is that the session auth allows you to actually login to the browserable API via your username and password and view the docs. I believe the token auth protects your API endpoints, and the session auth allows you to access them via browserable API. I'm not sure if exposing the session auth weakens security at all. I'll leave that to others.

Harry Moreno Over a year ago

works for me. Specify token above session and you can sign in on the phone app and browsable api.

Code-Apprentice Over a year ago

To clarify here for anyone reading these comments in the future, the browser is just an HTTP client like any other. Adding SessionAuthetication in this way allows this type of authentication for all clients, not just the browseable API.

pplonski · Accepted Answer · 2020-11-10 21:26:12Z

7

You can use a browser plugin to set token in the header. I'm using Modheader which is free.

The example of setting the header:

I wrote a blog post on how this can be done: link to post.

I like this solution because you don't need to change the auth classes.

edited Nov 10, 2020 at 21:26

answered Oct 29, 2020 at 15:30

pplonski

5,9772 gold badges40 silver badges36 bronze badges

1 Comment

nonamorando Over a year ago

This is the best response, because it does not require you to change your authentication scheme to use the browsable API. Thrilled to use this.

Harry Moreno · Accepted Answer · 2020-04-06 18:01:35Z

1

I did:

REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
    'rest_framework.authentication.TokenAuthentication',
    'rest_framework.authentication.SessionAuthentication',
),

and I added a custom auth class in api.py

class CustomAuthToken(ObtainAuthToken):

    authentication_classes = [TokenAuthentication]

    def post(self, request, *args, **kwargs):
        ...
        return Response({...})

See https://www.django-rest-framework.org/api-guide/authentication/#by-exposing-an-api-endpoint

answered Apr 6, 2020 at 18:01

Harry Moreno

11.9k8 gold badges75 silver badges120 bronze badges

Collectives™ on Stack Overflow

Django REST Framework: using TokenAuthentication with browsable API

3 Answers 3

5 Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

5 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related