Django Rest Framework behind HTTP Basic Authentication

Question

If my webservice (powered by Django Rest Framework, v2.3.8) is inside a location protected by Nginx's HTTP Basic Authentication, like so:

location / {
            auth_basic           "Restricted access";
            auth_basic_user_file /path/to/htpasswd;

            uwsgi_pass django;
            include /etc/uwsgi/config/uwsgi_params;
    }

Then, when a user authenticate and tries to access the API, the following response is obtained for all views:

{"detail": "Invalid username/password"}

Does Django Rest Framework pick up the HTTP Authorization header (meant for Nginx) even though the view requires no authentication? If so, how should I go about this?

Any help would be greatly appreciated.

chhantyal · Accepted Answer · 2015-10-20 10:17:41Z

8

By default, Django Rest Framework has two authentication classes, see here.

REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
    'rest_framework.authentication.SessionAuthentication',
    'rest_framework.authentication.BasicAuthentication'
)}

You can disable the rest framework authentication if you don't need it.

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': ()
}

Or you can remove only BasicAuthentication as it will work in your case.

REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
    'rest_framework.authentication.SessionAuthentication'
)}

edited Oct 20, 2015 at 10:17

chhantyal

12.3k9 gold badges55 silver badges79 bronze badges

answered Dec 18, 2013 at 16:19

ottojiang

913 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

panchicore Over a year ago

for security reasons dont disallow the default security settings

Fabio Montefuscolo Over a year ago

This answer works. You can tune application for security when you need security.

Community · Accepted Answer · 2017-05-23 11:48:19Z

2

As noted in another post, you must add a comma next to the authentication class or it can throw a TypeError.

'DEFAULT_PERMISSION_CLASSES': (
    'rest_framework.authentication.SessionAuthentication', #comma added here
)

Source: https://stackoverflow.com/a/22697034/5687330

edited May 23, 2017 at 11:48

CommunityBot

11 silver badge

answered Nov 2, 2016 at 14:32

Marc Aubin

313 bronze badges

Collectives™ on Stack Overflow

Django Rest Framework behind HTTP Basic Authentication

2 Answers 2

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related