How to prevent Django Rest Framework from validating the token if 'AllowAny' permission class is used?
<p>Let me show you my code first:</p>

<p>In <code>settings.py</code></p>

<pre><code>....
DEFAULT_AUTHENTICATION_CLASSES': (
    'rest_framework.authentication.TokenAuthentication',
),
'DEFAULT_PERMISSION_CLASSES': (
    'rest_framework.permissions.IsAuthenticated',
)
....
</code></pre>

<p>My <code>my_view.py</code>:</p>

<pre><code>@api_view(['POST'])
@permission_classes((AllowAny,))
def say_hello(request):
    return Response("hello")
</code></pre>

<p>As you can see, I'm using Token Authentication to protect my other API's by default, but <strong>when I add a token header</strong> in <code>say_hello</code>, Django Rest Framework will also check if the token is valid or not, even when i add <code>AllowAny</code> permission class.</p>

<p><strong>My question is</strong> how to make Django Rest Framework ignore checking the token if the token header is present in the <code>say_hello</code>?
and are there any security considerations for making this?</p>

<p>Thanks.</p>

<p>You seem to be mixing up <strong>authentication</strong> and <strong>authorization</strong>.</p>

<p>By using the <code>@permission_classes</code> decorator on your view, you have overridden the default authorization from settings.  But you still have the default authentication classes from settings.</p>

<p>Try adding also to your view another decorator, to bypass the <code>TokenAuthentication</code>:</p>

<pre><code>@authentication_classes([])
</code></pre>

<p>Note that if you put this on a <code>POST</code> endpoint, your app is now vulnerable to nasty stuff like Cross-Site Request Forgery.  </p>

python django django-rest-framework