Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: Return 401 for API request with Invalid Authorization #3663

Closed
wants to merge 9 commits into from
Closed

Fix: Return 401 for API request with Invalid Authorization #3663

Changes from 5 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
606d6c4
Fix: Change API behavior to return 401 Unauthorized instead of 403 Fo…
carlosm22700 Jan 15, 2024
8371936
change HEADERS to headers to align with drf
carlosm22700 Jan 15, 2024
d84d972
revert changes and refactor to follow DRF best practices
carlosm22700 Feb 9, 2024
6269210
remove uneeded import
carlosm22700 Feb 9, 2024
daf8d04
Merge branch 'main' into api-authentication-fix
dhruvkb Feb 9, 2024
48b9c92
Fix import order
dhruvkb Feb 9, 2024
8c2a9f7
Fix: Return 401 for API request with Invalid Authorizatio by implemen…
carlosm22700 Feb 18, 2024
fd01898
fix: return 401 when authorization is invalid when including header b…
carlosm22700 Feb 18, 2024
6fdad97
Restore deleted middleware for logging purposes.
carlosm22700 Feb 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion api/api/views/oauth2_views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
from drf_spectacular.utils import extend_schema
from oauth2_provider.generators import generate_client_secret
from oauth2_provider.views import TokenView as BaseTokenView
from oauth2_provider.contrib.rest_framework import TokenHasScope
from redis.exceptions import ConnectionError

from api.docs.oauth2_docs import key_info, register, token
Expand Down Expand Up @@ -167,6 +168,8 @@ def post(self, request):
@extend_schema(tags=["auth"])
class CheckRates(APIView):
throttle_classes = (OnePerSecond,)
permission_classes = (TokenHasScope,)
required_scopes = ["read"]
Comment on lines +171 to +172
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can be removed and the TODO later in the file added back. The precise condition is already handled where the TODO was, and we should address this in a separate PR to avoid complicating this one.


@key_info
def get(self, request, format=None):
Expand All @@ -180,7 +183,6 @@ def get(self, request, format=None):
> token has expired.
"""

# TODO: Replace 403 responses with DRF `authentication_classes`.
if not request.auth:
return Response(status=403, data="Forbidden")

Expand Down
Loading