Django DRF showing weired auth methode respective to URL

I'm facing a strange issue with Django REST Framework (DRF).

# views.py
class CheckoutView(APIView):    
    permission_classes = [AllowAny]
    
    def post(self, request, *args, **kwargs):
        return Response({'total_price': 7879})

#url.py
urlpatterns = [
    path("cart/checkout/<int:new>", checkoutView.as_view() , name="checkout"), # url 1
    path("cart/checkout/", checkoutView.as_view() , name="checkout"), # url 2
]

issue :
if i hit with url 1 it gives response 200

if i hit url 2 it gives response 401 { "detail": "Authentication credentials were not provided." }

note that : 'permission_classes = [AllowAny]' is there in the view also i dont have defined default permission class in settings.py

There is a difference between authenticating and permissions. An APIView has an .authentication_classes attribute as well, this determines how to check if a user has logged in. By default this has BasicAuthentication and SessionAuthentication.

Even if you thus don't need to have any permission, it will just run the authentication logic, and if there is for example a HTTP_AUTHORIZATION header in the request, it needs to be formatted for example like basic username:password.

You thus should look what authentication header you send to the view, and very likely it does not follow the right structure.

Вернуться на верх