"403 Forbidden" in Authentication tutorial (part 4)

[guitarmanvt]

Following the tutorial, I'm at this point:

http://www.django-rest-framework.org/tutorial/4-authentication-and-permissions/#authenticating-with-the-api

When I run http POST http://127.0.0.1:8000/snippets/ code="print 123", I do get the expected JSON response body, but the header is 403 Forbidden.

It seems to me that this should be 401 Unauthorized (since the very next example shows that Authorization does indeed help). But...it's possible that this is simply a rough edge in the tutorial code, so is it really a bug in DRF, or just something to note in the tutorial and move on?

I found these related issues:
#187
#410

[xordoquy]

You get a 403 because unauthenticated users are allowed to view the page but not allowed to POST there.

[guitarmanvt]

@xordoquy I think you may have misunderstood the question.

Yes, I agree and understand that unauthenticated users are not allowed to POST on this Resource. That is correct.

My question is about the status code.

According to http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html, the 403 Forbidden section says " Authorization will not help." In plain English, a 403 Forbidden should only be sent if the user is already authenticated and does not have access to the Resource.

I think DRF is sending the wrong HTTP Status Code. The correct status code is 401 Unauthorized, since my POST request did not include any authentication credentials whatsoever.

Am I communicating this concern clearly?

This is related to Issue #410, where a similar use case was discussed.

[lovelydinosaur]

The behavior there will depend on the ordering of the authentication classes.
In this case SessionAuthentication has priority, so a 401 response (which would result in browsers forcibly displaying the basic auth popup) is not returned.

The bit of bold text in this paragraph is relevant: http://www.django-rest-framework.org/api-guide/authentication/#unauthorized-and-forbidden-responses

The kind of response that will be used depends on the authentication scheme. Although multiple authentication schemes may be in use, only one scheme may be used to determine the type of response. The first authentication class set on the view is used when determining the type of response.

[guitarmanvt]

Thank you, @tomchristie . My take-away is that the 403 Forbidden is a proper side-effect of the tutorial code. Once I finish the tutorial, I can dig deeper into the API Guide for more details. :)

[lovelydinosaur]

My take-away is that the 403 Forbidden is a proper side-effect of the tutorial code.

That's right, yup 😄