Django rest 框架：创建用户请求身份验证

Question

我正在使用 django 用户、身份验证和权限模块，但是在 POST 请求中请求创建新用户时，它要求进行身份验证。

我得到了

{
    "detail": "Authentication credentials were not provided."
}

这是我的 serializers.py

class UserSerializer(serializers.ModelSerializer):
    class Meta:
        model = User
        fields = ['id', 'username', 'password']

        extra_kwargs = {
            'password' : {
                'write_only':True,
                'required': True
            }
        }
    
    def create(self, validated_data):
        user = User.objects.create_user(**validated_data)
        Token.objects.create(user=user) # create token for the user
        return user

    def update(self, instance, validated_data):
        instance.username = validated_data['username']
        instance.set_password(validated_data['password'])
        instance.save()

        return instance

views.py

class UserViewSet(viewsets.ModelViewSet):
    queryset = User.objects.all()
    serializer_class = UserSerializer

    permission_classes = [IsAuthenticated, IsOwnerOfObject]
    authentication_classes = (TokenAuthentication,)

urls.py

from django.urls import path, include
from .views import UserViewSet
from rest_framework.routers import DefaultRouter

router = DefaultRouter()
router.register('users', UserViewSet, basename = 'users')

urlpatterns = [
    path('api/', include(router.urls)), 
]

Answer 1

这是因为您设置的 permission_classes 包括 IsAuthenticated。如果您想像下面的示例代码那样通过用户创建将其公开，则必须实现允许它的自定义 Permission 类。

class CustomizedUserPermission(IsAuthenticated):
    def has_permission(self, request, view):
        if view.action == 'create':
            return True
        return super().has_permission(request, view)  
      
class UserViewSet(viewsets.ModelViewSet):
    ...
    permission_classes = [CustomizedUserPermission, ]

更新为覆盖 ViewSet 中的 get_permissions 类

class UserViewSet(viewsets.ModelViewSet):
    def get_permissions(self): 
        if self.action == 'create': 
                return [] 
        return super().get_permissions()