Take the 2-minute tour ×

For the project I'm currently working on, I decided to write a custom authentication model. I'm using both the rest-framework and all-access. The local authentication is not implemented yet (it is, but in a different version, so no issue there).

The User model registers properly and OAuth authentication works. Users get logged alright.

When working with views, authentication works properly if I use django's View as base class. Not so much if I use rest-framework's APIView.

In my ProfileView (LOGIN_REDIRECT_URL redirects here) I receice a rest_framework.request.Request instance, which is OK by me. The problem is:

request.user is an instance of AnonymousUser (even after login)

I would guess the problem lies with my implementation, but then:

request._request.user is an authenticated user

(Note that request._request is the original django request)

I tend to think this is a rest-framework bug, but maybe one of you knows of a workaround?

Edit Just to note that the login is made in a non-APIView class, but instead in a class that inherits from View. That's probably the reason the User instance is not passed to the APIView instance.

share|improve this question
provide some code, what you have done? –  Yadav Chetan Apr 28 '13 at 5:15
Well, in this case I didn't think it would be necessary because, well, it works! In my get_or_create_user() method I have this: return User.objects.create_user(**kwargs) which does return a User instance (kwargs is a standard dictionary with all the fields). The problem is not authenticating, the problem is that the rest-framework seems to be creating its own AnonymousUser instance, instead of using the one provided by django natively. –  André Fratelli Apr 28 '13 at 5:20
add comment

1 Answer

You need to set the DEFAULT_AUTHENTICATION_CLASSES in your settings.py. Else DRF will default to None as request.auth and AnonymousUser as request.user


Once you set that and the user is logged in, ensure that the session_id is available in the request headers. Browsers typically store the session information and pass it in the headers of all requests.

If you are using a non-browser client (Eg. a mobile app), you will need to set the session id manually in the header.

Also since you mentioned you use oauth to sign-in the user, for oauth2 you need to specify the oauth2 authorization header instead of the session id.

"Authorization: Bearer <your-access-token>" 

Refer to Authenticating in Django Rest Framework

share|improve this answer
I'm not using rest-framework's authentication model. I have defined my own backend and user model. What should I put there, then? –  André Fratelli Apr 28 '13 at 5:35
Btw, I'm using session authentication. –  André Fratelli Apr 28 '13 at 5:37
You will need to implement your custom authetication by subclassing Baseauthentication and provide that method in the settings.py. Eg django-rest-framework.org/api-guide/… –  Pratik Mandrekar Apr 28 '13 at 6:14
It didn't work =\ –  André Fratelli Apr 28 '13 at 6:29
add comment

Your Answer


