Django-rest-framework权限

Question

I have UserList

from rest_framework import permissions

class UserList(generics.ListCreateAPIView):
    queryset = User.objects.all()
    serializer_class = UserSerializer
    permission_classes = (permissions.IsAuthenticated,)

As you see I need access only to authenticated users, but I always have all permissions. Any idea?

Answer 1

The code looks fine. There are a few things you can try:

1. As @Druhin mentioned, ensure you've attempted the request in a new incognito window to ensure you don't have a cookie or something authenticating you.
2. Ensure you are reaching the correct URL. Are you sure you don't have another view mapped to that specific URL?
3. As an even more solid method, use CURL to send the request.
4. This is not your problem, but you can also configure default permissions for the rest framework.

For example, in settings.py:

 REST_FRAMEWORK = {
      'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
     )
 }

If none of those options work, please post your settings and any other relevant code.