Agfdhyk

When I attempt to test my Create/POST route for my Django Rest Framework API I receive a response status code of 401 with the error detail telling me ErrorDetail(string=u'Authentication credentials were not provided.', code=u'not_authenticated'). The weird thing is I Django tells me I'm authenticated when I check is is_authenticated.

Does anyone have an idea what might be causing this? All relevant code provided below.

# test_api.py



def authorise_user_and_test_is_authenticated(self, user_id):

    """

    Log in user and test this is successful

    """

    user = User.objects.get(pk=user_id)

    self.client.login(username=user.username, password=user.password)

    authorised_user = auth.get_user(self.client)

    return self.assertTrue(user.is_authenticated())



def test_create_project(self):

    '''

        When given valid parameters a project is created.

    '''

    user = User.objects.get(username="user_001")

    self.authorise_user_and_test_is_authenticated(user.id) # pass of authenication and auth testing to method, when tested with is_authenicated() it returns true.



    response = self.client.post('/api/user/{0}/project/create/'.format(user.id),

                                 json.dumps({"model_name": "POSTed Project",

                                             "description": "Project tested by posting",

                                             "shared_users": [2]

                                             }),

                                 content_type='application/json')



    self.assertEqual(response.status_code, 201)

# views.py



class MyCreateView(generics.GenericAPIView):

    pass

    serializer_class = FerronPageCreateAndUpdateSerializer



    def get_queryset(self):

        return User.objects.filter(pk=self.kwargs.get('user'))



    def post(self, request, format=None, **kwargs):

        # This dictionary is used to ensure that the last_modified_by field is always updated on post to be the current user

        print request.data

        request_data = {

            'user': request.user.id,

            'model_name': request.data['model_name'],

            'description': request.data['description'],

            'last_modified_by': request.user.id,

            'shared_users': request.data.getlist('shared_users', )

        }

        serializer = FerronPageCreateAndUpdateSerializer(data=request_data)



        if serializer.is_valid():

            serializer.save()

            return Response(serializer.data, status=status.HTTP_201_CREATED)

        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

# settings.py



REST_FRAMEWORK = {

    # Use Django's standard `django.contrib.auth` permissions,

    # or allow read-only access for unauthenticated users.

    'DEFAULT_PERMISSION_CLASSES': [

        'rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly'

    ],

    'DEFAULT_AUTHENTICATION_CLASSES': (

       'rest_framework.authentication.TokenAuthentication',

       'rest_framework.authentication.SessionAuthentication'

   ),

}

# url matcher



url(r'^user/(?P<user>d+)/project/create/$', MyCreateView.as_view(), name='create-project')

class FerronPageCreateAndUpdateSerializer(serializers.ModelSerializer):

shared_users = serializers.PrimaryKeyRelatedField(many=True, queryset=User.objects.all(), read_only=False)

description  = serializers.CharField(max_length=300, trim_whitespace=True, required=False, allow_blank=True)



class Meta:

    model = Project

    fields = [

      'pk',

      'user',

      'data',

      'model_name',

      'description',

      'created_at',

      'date_modified',

      'shared_users',

      'last_modified_by'

]

Turn's out the issue was here self.client.login(username=user.username, password=user.password) inside the authorise_user_and_test_is_authenticated(self, user_id) method.

The problem was that I was using the password an instance of a user I had already created. This meant when I gave the argument password=user.password, I was trying to log in using a password that had already been hashed. What I needed to do instead was log in with the original unhashed version of the password e.g. password='openseasame'.