Django DRF: custom Permission: tokenauthentication: Why to use isAuthenticated for permission - django

Question

I have the following
REST_FRAMEWORK = {
'DEFAULT_PERMISSION_CLASSES': (
'rest_framework.permissions.AllowAny',
),
'DEFAULT_AUTHENTICATION_CLASSES': (
'rest_framework.authentication.TokenAuthentication',
),
'DEFAULT_RENDERER_CLASSES': (
'rest_framework.renderers.JSONRenderer',
'rest_framework.renderers.BrowsableAPIRenderer',
)
}
How does DRF get the request.user
def hello_world(request):
print(request.user)
return Response()
I am trying
curl --location --request GET "http://127.0.0.1:8000/hello-world/" \
--header "Authorization:Token ssssss28acbd550a9806c6ac9ce13f1bbc73137" \
--header 'Content-Type: application/json'
so in the output i see the request.user is printed as per the token supplied i.e eg: test
Then what is the use of using isAuthenticated
It only checks whether Authentication header is provided or not
Why cant that be checked by tokenauthentication itself

Answer 1

To my understanding, token authentication is not a custom permission. Authentication and permission are 2 different things.
If you check out the DRF site https://www.django-rest-framework.org/api-guide/authentication/, they say:
Authentication is the mechanism of associating an incoming request with a set of identifying credentials, such as the user the request came from, or the token that it was signed with. The permission and throttling policies can then use those credentials to determine if the request should be permitted.
So authentication is the underlying mechanism of how you authenticate users, e.g. token authentication, session authentication etc ... Permission regulates whether a request should be granted based on the identifying credentials which were retrieved from the authentication mechanism.
So in your example, the default authentication mechanism uses tokens. This applies to all your views (unless you override this explicitly in a particular view). You then send a http request to the endpoint handled by the hello_world view. In this http request you supply a token in the header. The authentication mechanism will attempt to match this token with a unique django user model instance in the database. This happens through DRF's Request class which extends the standard django HttpRequest, an instance of which is passed to the hello_world view. If you delve into the source code, you can see that user in request.user has a property decorator:
#property
def user(self):
"""
Returns the user associated with the current request, as authenticated
by the authentication classes provided to the request.
"""
if not hasattr(self, '_user'):
with wrap_attributeerrors():
self._authenticate()
return self._user
so that request.user triggers the authentication mechanism in the background if self._user hasn't been previously set and returns a django user model instance. I think this is roughly how DRF gets request.user.
To answer the second part of your question, again, token authentication only refers to the mechanism, it doesn't make any checks. So the use of isAuthenticated permission is to ensure only authenticated users, who have been authenticated by token authentication, are granted a successful response. Removing isAuthenticated would allow a user to receive a successful response without providing a token.