def authenticate(self, request):

        # Get the session-based user from the underlying HttpRequest object
        user = getattr(request._request, 'user', None)

        # Unauthenticated, CSRF validation not required
        if not user or not user.is_active:
            return None

        self.enforce_csrf(request)

        # CSRF passed with authenticated user
        return (user, None)
Returns a `User` if the request session currently has a logged in user.
dataset/ETHPy150Open tomchristie/django-rest-framework/rest_framework/authentication.py/SessionAuthentication.authenticate