{"action":"created","issue":{"url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3893","labels_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3893/labels{/name}","comments_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3893/comments","events_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3893/events","html_url":"https://github.com/tomchristie/django-rest-framework/issues/3893","id":130698833,"number":3893,"title":"Expected a `Response`, `HttpResponse` or `HttpStreamingResponse` to be returned from the view, but received a `<class 'rest_framework.exceptions.PermissionDenied'>","user":{"login":"JensTimmerman","id":281523,"avatar_url":"https://avatars.githubusercontent.com/u/281523?v=3","gravatar_id":"","url":"https://api.github.com/users/JensTimmerman","html_url":"https://github.com/JensTimmerman","followers_url":"https://api.github.com/users/JensTimmerman/followers","following_url":"https://api.github.com/users/JensTimmerman/following{/other_user}","gists_url":"https://api.github.com/users/JensTimmerman/gists{/gist_id}","starred_url":"https://api.github.com/users/JensTimmerman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JensTimmerman/subscriptions","organizations_url":"https://api.github.com/users/JensTimmerman/orgs","repos_url":"https://api.github.com/users/JensTimmerman/repos","events_url":"https://api.github.com/users/JensTimmerman/events{/privacy}","received_events_url":"https://api.github.com/users/JensTimmerman/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-02T14:32:05Z","updated_at":"2016-02-02T14:41:49Z","closed_at":null,"body":"```\r\nTraceback (most recent call last):\r\n  File \"/usr/lib/python2.7/site-packages/django/core/handlers/base.py\", line 132, in get_response\r\n    response = wrapped_callback(request, *callback_args, **callback_kwargs)\r\n  File \"/usr/lib/python2.7/site-packages/django/utils/decorators.py\", line 145, in inner\r\n    return func(*args, **kwargs)\r\n  File \"/usr/lib/python2.7/site-packages/django/views/generic/base.py\", line 71, in view\r\n    return self.dispatch(request, *args, **kwargs)\r\n  File \"/usr/lib/python2.7/site-packages/django/views/decorators/csrf.py\", line 58, in wrapped_view\r\n    return view_func(*args, **kwargs)\r\n  File \"/usr/lib/python2.7/site-packages/rest_framework/views.py\", line 401, in dispatch\r\n    self.response = self.finalize_response(request, response, *args, **kwargs)\r\n  File \"/usr/lib/python2.7/site-packages/rest_framework/views.py\", line 332, in finalize_response\r\n    % type(response)\r\nAssertionError: Expected a `Response`, `HttpResponse` or `HttpStreamingResponse` to be returned from the view, but received a `<class 'rest_framework.exceptions.PermissionDenied'>`.\r\n```\r\n\r\nWhen a request with insufficient permissions is made in views.dispatch the following happens:\r\n\r\nin dispatch:\r\nself.initial (request)\r\nwill call self.check_permissions(request)\r\nwhich will call self.permission_denied(request)\r\nthis will raise a rest_framework.exceptions.PermissionDenied()\r\n\r\nthis exception is except'ed in dispatch, where\r\nrespons = self.handle_exception(exc) is called\r\n\r\nhandle_exception only checks for exceptions of instance `NotAuthenticated or AuthenticationFailed`, but not for PermissionDenied (which would also be appropriate for a 403_FORBIDDEN response, no?)\r\n\r\nAfter this, response is generated as by `self.settings.EXCEPTION_HANDLER(exc)`\r\nwhich in this case does not seem to generate a valid response, since I'm getting this internal server error.\r\n\r\nIt would be nice if:\r\n1. The response was 403_FROBIDDEN if there's a Permissiondenied\r\n2. The default self.settings.EXCEPTION_HANDLER would print out some info on how to change it's behavior (at the moment I don't know where to start looking to set the default exception handler)\r\n3. The default EXCEPTION_HANDLER would generate valid HttpResponse's"},"comment":{"url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/comments/178604242","html_url":"https://github.com/tomchristie/django-rest-framework/issues/3893#issuecomment-178604242","issue_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3893","id":178604242,"user":{"login":"JensTimmerman","id":281523,"avatar_url":"https://avatars.githubusercontent.com/u/281523?v=3","gravatar_id":"","url":"https://api.github.com/users/JensTimmerman","html_url":"https://github.com/JensTimmerman","followers_url":"https://api.github.com/users/JensTimmerman/followers","following_url":"https://api.github.com/users/JensTimmerman/following{/other_user}","gists_url":"https://api.github.com/users/JensTimmerman/gists{/gist_id}","starred_url":"https://api.github.com/users/JensTimmerman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JensTimmerman/subscriptions","organizations_url":"https://api.github.com/users/JensTimmerman/orgs","repos_url":"https://api.github.com/users/JensTimmerman/repos","events_url":"https://api.github.com/users/JensTimmerman/events{/privacy}","received_events_url":"https://api.github.com/users/JensTimmerman/received_events","type":"User","site_admin":false},"created_at":"2016-02-02T14:41:48Z","updated_at":"2016-02-02T14:41:48Z","body":"Further investigation reveals that the default exception_handler is the `exception_handler` method in views.py\r\n\r\nwhich does\r\n```\r\n\r\n    elif isinstance(exc, PermissionDenied):\r\n        msg = _('Permission denied.')\r\n        data = {'detail': six.text_type(msg)}\r\n\r\n        set_rollback()\r\n        return Response(data, status=status.HTTP_403_FORBIDDEN)\r\n```\r\n\r\nwhich looks ok at first, but it turns out `PermissionDenied` is `django.core.exceptions.PermissionDenied` whereas a `rest_framework.exceptions.PermissionDenied` was raised."}}