@view_config(context=httpexceptions.HTTPForbidden, permission=NO_PERMISSION_REQUIRED)
def authorization_required(response, request):
 if (Authenticated not in request.effective_principals):
  error_msg = 'Please authenticate yourself to use this endpoint.'
  response = http_error(httpexceptions.HTTPUnauthorized(), errno=ERRORS.MISSING_AUTH_TOKEN, message=error_msg)
  response.headers.extend(forget(request))
  return response
 if (response.content_type != 'application/json'):
  error_msg = 'This user cannot access this resource.'
  response = http_error(httpexceptions.HTTPForbidden(), errno=ERRORS.FORBIDDEN, message=error_msg)
 return reapply_cors(request, response)

@ view_config ( context = httpexceptions . HTTPForbidden , permission = NO_PERMISSION_REQUIRED ) def authorization_required ( response , request ) : if ( Authenticated not in request . effective_principals ) : error_msg = 'Please authenticate yourself to use this endpoint.' response = http_error ( httpexceptions . HTTPUnauthorized ( ) , errno = ERRORS . MISSING_AUTH_TOKEN , message = error_msg ) response . headers . extend ( forget ( request ) ) return response if ( response . content_type != 'application/json' ) : error_msg = 'This user cannot access this resource.' response = http_error ( httpexceptions . HTTPForbidden ( ) , errno = ERRORS . FORBIDDEN , message = error_msg ) return reapply_cors ( request , response )
distinguish authentication required from not allowed .