How to prevent Django Rest Framework from validating the token if 'AllowAny' permission class is used?
<p>Let me show you my code first:</p>

<p>In <code>settings.py</code></p>

<pre><code>....
DEFAULT_AUTHENTICATION_CLASSES': (
    'rest_framework.authentication.TokenAuthentication',
),
'DEFAULT_PERMISSION_CLASSES': (
    'rest_framework.permissions.IsAuthenticated',
)
....
</code></pre>

<p>My <code>my_view.py</code>:</p>

<pre><code>@api_view(['POST'])
@permission_classes((AllowAny,))
def say_hello(request):
    return Response("hello")
</code></pre>

<p>As you can see, I'm using Token Authentication to protect my other API's by default, but <strong>when I add a token header</strong> in <code>say_hello</code>, Django Rest Framework will also check if the token is valid or not, even when i add <code>AllowAny</code> permission class.</p>

<p><strong>My question is</strong> how to make Django Rest Framework ignore checking the token if the token header is present in the <code>say_hello</code>?
and are there any security considerations for making this?</p>

<p>Thanks.</p>

<p>I think the answer to <a href="http://stackoverflow.com/questions/33539606/excluding-basic-authentication-in-a-single-view-django-rest-framework">this question</a> applies here as well.</p>

<p>If you don't want to check tokens for one view, you can add <code>@authentication_classes([])</code> to the view. That should keep the default in place for other views while treating this one differently.</p>

python django django-rest-framework