diff --git a/djangorestframework/tests/authentication.py b/djangorestframework/tests/authentication.py index fb9996be4..da003a053 100644 --- a/djangorestframework/tests/authentication.py +++ b/djangorestframework/tests/authentication.py @@ -127,13 +127,13 @@ class TokenAuthTests(TestCase): def test_post_form_passing_token_auth(self): """Ensure POSTing json over token auth with correct credentials passes and does not require CSRF""" - auth = self.key + auth = 'Token %s' % self.key response = self.csrf_client.post('/', {'example': 'example'}, HTTP_AUTHORIZATION=auth) self.assertEqual(response.status_code, 200) def test_post_json_passing_token_auth(self): """Ensure POSTing form over token auth with correct credentials passes and does not require CSRF""" - auth = self.key + auth = 'Token %s' % self.key response = self.csrf_client.post('/', json.dumps({'example': 'example'}), 'application/json', HTTP_AUTHORIZATION=auth) self.assertEqual(response.status_code, 200) diff --git a/djangorestframework/tokenauth/authentication.py b/djangorestframework/tokenauth/authentication.py index 35d562115..167edf96f 100644 --- a/djangorestframework/tokenauth/authentication.py +++ b/djangorestframework/tokenauth/authentication.py @@ -15,19 +15,22 @@ class TokenAuthentication(BaseAuthentication): The BaseToken class is available as an abstract model to be derived from. The token key should be passed in as a string to the "Authorization" HTTP - header. + header. For example: + + Authorization: Token 0123456789abcdef0123456789abcdef + """ model = Token def authenticate(self, request): - key = request.META.get('HTTP_AUTHORIZATION', '').strip() - if not key: - return None + auth = request.META.get('HTTP_AUTHORIZATION', '').strip().split() + if len(auth) == 2 and auth[0].lower() == "token": + key = auth[1] - try: - token = self.model.objects.get(key=key) - except self.model.DoesNotExist: - return None + try: + token = self.model.objects.get(key=key) + except self.model.DoesNotExist: + return None - if token.user.is_active and not token.revoked: - return (token.user, token) + if token.user.is_active and not token.revoked: + return (token.user, token)