Django-rest-framework-JWT身份验证

Question

In my settings.py file I have set this:

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework_jwt.authentication.JSONWebTokenAuthentication',
    ),
}

Now, I have created a ListCreateAPIView :

class ListSubreddits(ListCreateAPIView):
    queryset = Subreddit.objects.all()
    authentication_classes = (JSONWebTokenAuthentication, )

    def get_serializer_class(self):
        if self.request.method == 'GET':
            return SubredditSerializer_detailed
        if self.request.method == 'POST':
            return SubredditSerializer

So, I have sent a POST request creating without just content-type header and the POST request was successful. I haven't provided any Authentication or Authorization headers. What am I missing here?

Answer 1

you must add permission to your view :

from rest_framework import permissions

class ListSubreddits(ListCreateAPIView):

    queryset = Subreddit.objects.all()
    authentication_classes = (JSONWebTokenAuthentication, )
    permission_classes = (permissions.IsAuthenticated, )

    def get_serializer_class(self):
        if self.request.method == 'GET':
            return SubredditSerializer_detailed
        if self.request.method == 'POST':
            return SubredditSerializer

Answer 2

Change your settings for REST_FRAMEWORK in settings.py to the following:

REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
    ),
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework_jwt.authentication.JSONWebTokenAuthentication',
    )
}