Django authorizing request even if permissions.AllowAny is set - reactjs

Question

I am working on a Django REST framework project. I am using JWT authentication, in my login view i have set permission classes to AllowAny. '
#decorators.api_view(["POST"])
#decorators.permission_classes([permissions.AllowAny])
def login(request):
print("REQUEST in login = ", request)
try:
username = request.data['username']
print(username)
user = User.objects.get(username=username)
except Exception as e:
return response.Response({'username': "User doesn't exist"} , status.HTTP_400_BAD_REQUEST)
try:
password = request.data["password"]
print(password)
except:
return response.Response({"password": "Password not valid"}, status.HTTP_400_BAD_REQUEST)
user = authenticate(username=username, password=password)
if user is not None:
refresh = RefreshToken.for_user(user)
res = {
"message": "Logged in successfully",
"refresh": str(refresh),
"access": str(refresh.access_token),
}
return response.Response(res, status.HTTP_200_OK)
else:
return response.Response({"password": "Password not valid"}, status=status.HTTP_400_BAD_REQUEST)
When i send a normal request everything works as expected.
But when i set the Authorization header to empty string (or null both have same problem)
Authorization: null or ''
The reason why Authorization is set to null is because of axios in React. It looks for access token in local storage. If not present it sets it to null.
const axiosInstance = axios.create({
baseURL: baseURL,
timeout: 60000,
headers: {
Authorization: localStorage.getItem('access_token')
? 'Bearer ' + localStorage.getItem('access_token')
: null,
'Content-Type': 'application/json',
accept: 'application/json',
},
});
I have set the default authentication to JWT in django.
REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
'rest_framework_simplejwt.authentication.JWTAuthentication',
)
}
I can think of removing the Authorization header and setting new axiosInstance while logging in. But this will make the code less cleaner. Please suggest any fix for this problem.

Answer 1

You can provide a custom subclass of rest_framework_simplejwt.authentication.JWTAuthentication and handle the value of the header any way you like.
import re
from rest_framework_simplejwt.authentication import JWTAuthentication
class CustomJWTAuthentication(JWTAuthentication):
def get_header(self, request):
header = super().get_header(request)
# value is usually "Bearer <token>"
if header is None:
return header
if not re.match("Bearer \S+", header)
return None
return header
We are doing this because JWTAuthentication will only skip checking when JWTAuthentication.get_header() returns None else it will keep going.
So providing values like null, undefined, or an empty string in axios will send it's string representation (e.g. null will be "null") and JWTAuthentication will take it as it is.
Another solution outside django but in axios is to not include it through tranformRequest.
const apiAxios = axios.create({
baseURL: baseURL.href,
transformRequest: [
function (data, headers) {
const accessToken = window.localStorage.getItem("accessToken")
if (accessToken) {
headers['Authorization'] = `Bearer ${accessToken}`
} else {
delete headers.Authorization
}
return JSON.stringify(data)
}
],
headers: defaultApiHeaders,
});