Do not require authentication for GET requests fro

Question

This question is closely related to Do not require authentication for OPTIONS requests

My settings.py

REST_FRAMEWORK = {
    'UNICODE_JSON': True,
    'NON_FIELD_ERRORS_KEY': '__all__',
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.TokenAuthentication',
    ),
    'DEFAULT_PERMISSION_CLASSES': (
        'platformt_core.something.permissions.DjangoObjectPermissionsOrOptions',
    ),
    'DEFAULT_RENDERER_CLASSES': (
        'rest_framework.renderers.JSONRenderer',
    ),
    'ALLOWED_VERSIONS': ['v1'],
    'DEFAULT_VERSIONING_CLASS': 'rest_framework.versioning.NamespaceVersioning',
    'TEST_REQUEST_DEFAULT_FORMAT': 'json',
    'TEST_REQUEST_RENDERER_CLASSES': (
        'rest_framework.renderers.JSONRenderer',
    )
}

platformt_core/something/permissions.py

from rest_framework.permissions import DjangoObjectPermissions

OPTIONS_METHOD = 'OPTIONS'

class DjangoObjectPermissionsOrOptions(DjangoObjectPermissions):
    def has_permission(self, request, view):
        if request.method == OPTIONS_METHOD:
            return True
        else:
            return super(DjangoObjectPermissions, self).has_permission(request, view)

When I do this request from browser:

GET /api/passenger/v1/order/ HTTP/1.1
Host: 127.0.0.1:8000
Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: csrftoken=3XytVl8Oh2PJxcSs1ufI9TIZMOTC5Pix

I expect something neat like "Self describing APIs" described at http://www.django-rest-framework.org/topics/documenting-your-api/

But instead I get:

HTTP/1.0 401 UNAUTHORIZED
Date: Wed, 08 Jul 2015 20:45:23 GMT
Server: WSGIServer/0.1 Python/2.7.6
Content-Type: application/json;q=0.8; charset=utf-8
WWW-Authenticate: Token
Allow: POST, OPTIONS

{"detail":"Authentication credentials were not provided."}

Is there a neat way to achieve that? I mean I would like have browseable API, but API requests should be still secured with authentication.

Answer 1

Can't you just use?

'DEFAULT_PERMISSION_CLASSES': ('rest_framework.permissions.IsAuthenticatedOrReadOnly',)

This will allow read-only access to unauthenticated users.