不要求浏览器对GET请求进行身份验证 [英] Do not require authentication for GET requests from browser

问题描述

此问题与不需要认证OPTIONS请求密切相关。 a>

This question is closely related to Do not require authentication for OPTIONS requests

我的settings.py

My settings.py

REST_FRAMEWORK = {
    'UNICODE_JSON': True,
    'NON_FIELD_ERRORS_KEY': '__all__',
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.TokenAuthentication',
    ),
    'DEFAULT_PERMISSION_CLASSES': (
        'platformt_core.something.permissions.DjangoObjectPermissionsOrOptions',
    ),
    'DEFAULT_RENDERER_CLASSES': (
        'rest_framework.renderers.JSONRenderer',
    ),
    'ALLOWED_VERSIONS': ['v1'],
    'DEFAULT_VERSIONING_CLASS': 'rest_framework.versioning.NamespaceVersioning',
    'TEST_REQUEST_DEFAULT_FORMAT': 'json',
    'TEST_REQUEST_RENDERER_CLASSES': (
        'rest_framework.renderers.JSONRenderer',
    )
}

platformt_core / something / permissions.py

platformt_core/something/permissions.py

from rest_framework.permissions import DjangoObjectPermissions

OPTIONS_METHOD = 'OPTIONS'

class DjangoObjectPermissionsOrOptions(DjangoObjectPermissions):
    def has_permission(self, request, view):
        if request.method == OPTIONS_METHOD:
            return True
        else:
            return super(DjangoObjectPermissions, self).has_permission(request, view)

当我从浏览器执行此请求时：

When I do this request from browser:

GET /api/passenger/v1/order/ HTTP/1.1
Host: 127.0.0.1:8000
Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: csrftoken=3XytVl8Oh2PJxcSs1ufI9TIZMOTC5Pix

我期待像自我描述的API http://www.django-rest-framework.org/topics / documenting-your-api /

I expect something neat like "Self describing APIs" described at http://www.django-rest-framework.org/topics/documenting-your-api/

但是我得到：

HTTP/1.0 401 UNAUTHORIZED
Date: Wed, 08 Jul 2015 20:45:23 GMT
Server: WSGIServer/0.1 Python/2.7.6
Content-Type: application/json;q=0.8; charset=utf-8
WWW-Authenticate: Token
Allow: POST, OPTIONS

{"detail":"Authentication credentials were not provided."}

有没有办法实现呢？我的意思是我想要可浏览的API，但API请求应该仍然通过身份验证。

Is there a neat way to achieve that? I mean I would like have browseable API, but API requests should be still secured with authentication.

推荐答案

你不能使用？

'DEFAULT_PERMISSION_CLASSES': ('rest_framework.permissions.IsAuthenticatedOrReadOnly',)

这将允许对未经身份验证的用户进行只读访问。

This will allow read-only access to unauthenticated users.

这篇关于不要求浏览器对GET请求进行身份验证的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！