Why SessionAuthentication in Django REST Framework never returns HTTP401
Looking at the docs and source from the Django REST Framework, I see that SessionAuthentication
only HTTP returns 403, while other classes Authentication
return 401. What is the reason for this?
Of course, there are many cases where 401 makes sense .
The problem is especially problematic because "the first authentication type set on the view is used in determining the response type." and SessionAuthentication
is first class by default Authentication
.
source to share
Django REST Framework adheres to the HTTP specification and does not return a 401 response when the class Authentication
does not return WWW-Authenticate
, which you can use.
HTTP 401 responses should always include a header
WWW-Authenticate
that tells the client how to authenticate. HTTP 403 responses do not include a headerWWW-Authenticate
.
Since the class SessionAuthentication
does not define a header WWW-Authenticate
that can be used, Django REST Framework cannot return 401 responses and still follow the spec. You can get around this by installing another class Authentication
that maintains a header at the top of your list, eg BasicAuthentication
.
source to share