permission_classes = [IsAuthenticated] raises a 403 and not 401

[golthmike]

Somehow using the permission class IsAuthenticated raises HTTP_403_FORBIDDEN and not HTTP_401_UNAUTHORIZED when users are not authenticated.

I believe the problem lies in the APIView's permission_denied method (code below).

Is this a bug or am I missing something?

def permission_denied(self, request, message=None, code=None):
    """
    If request is not permitted, determine what kind of exception to raise.
    """
    if request.authenticators and not request.successful_authenticator:
        raise exceptions.NotAuthenticated()
    raise exceptions.PermissionDenied(detail=message, code=code)

[realsuayip]

I think the behavior is dependent on the authentication class; which one are you using?

[golthmike]

Oh great. Thanks for pointing that out!

I never set anything explicitly and couldn't find what is used by default. Do you happen to know that?

But SessionAuthentication raises a 403 by default so I guess that is what is used.