Add UNAUTHENTICATED_USER = None note by carltongibson · Pull Request #5679 · encode/django-rest-framework (original) (raw)
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Conversation2 Commits1 Checks0 Files changed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters
[ Show hidden characters]({{ revealButtonHref }})
When removing authentication entirely you cannot import django.contrib.auth.models.AnonymousUser
Closes #3494
Adds a note to the UNAUTHENTICATED_USER setting docs saying to set to None.
- Deprecation warning for APIs that do not use auth #3494 has been sat there forever. It's never going to be addressed directly, so beyond this I don't see what we can do.
- I think removing
django.contrib.authis sufficiently beyond the core case that we can expect users to have discovered this (or do so with a quick search).
When removing authentication entirely you cannot import django.contrib.auth.models.AnonymousUser
Closes encode#3494
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We could probably get around this by changing this line with:
'UNAUTHENTICATED_USER': 'django.contrib.auth.models.AnonymousUser' if 'django.contrib.auth' in settings.INSTALLED_APPS,
also should include a check on django.contrib.auth.apps.AuthConfig
@xordoquy Good point. It'd be good to see this bulletproofed.
I don't see the ROI on testing it thoroughly myself though: it's been two years with no PR, so it can't be hurting too-many people. 🙂
To the future: Happy to see a PR improving this!
pchiquet pushed a commit to pchiquet/django-rest-framework that referenced this pull request
When removing authentication entirely you cannot import django.contrib.auth.models.AnonymousUser
Closes encode#3494
2 participants
