mirror of
https://github.com/encode/django-rest-framework.git
synced 2025-12-11 20:24:10 +03:00
Deployed 3a70eb2 with MkDocs version: 1.6.0
This commit is contained in:
parent
788324b364
commit
d1bb692f4b
|
|
@ -763,7 +763,10 @@ TokenAdmin.raw_id_fields = ['user']
|
|||
</ul>
|
||||
<p>Unauthenticated responses that are denied permission will result in an <code>HTTP 403 Forbidden</code> response.</p>
|
||||
<p>If you're using an AJAX-style API with SessionAuthentication, you'll need to make sure you include a valid CSRF token for any "unsafe" HTTP method calls, such as <code>PUT</code>, <code>PATCH</code>, <code>POST</code> or <code>DELETE</code> requests. See the <a href="https://docs.djangoproject.com/en/stable/howto/csrf/#using-csrf-protection-with-ajax">Django CSRF documentation</a> for more details.</p>
|
||||
<p><strong>Warning</strong>: Always use Django's standard login view when creating login pages. This will ensure your login views are properly protected.</p>
|
||||
<div class="admonition warning">
|
||||
<p class="admonition-title">Warning</p>
|
||||
<p>Always use Django's standard login view when creating login pages. This will ensure your login views are properly protected.</p>
|
||||
</div>
|
||||
<p>CSRF validation in REST framework works slightly differently from standard Django due to the need to support both session and non-session based authentication to the same views. This means that only authenticated requests require CSRF tokens, and anonymous requests may be sent without CSRF tokens. This behavior is not suitable for login views, which should always have CSRF validation applied.</p>
|
||||
<h2 id="remoteuserauthentication"><a class="toclink" href="#remoteuserauthentication">RemoteUserAuthentication</a></h2>
|
||||
<p>This authentication scheme allows you to delegate authentication to your web server, which sets the <code>REMOTE_USER</code>
|
||||
|
|
|
|||
|
|
@ -885,10 +885,11 @@ In this case you can underspecify the media types it should respond to, by using
|
|||
</code></pre>
|
||||
<h2 id="jsonp"><a class="toclink" href="#jsonp">JSONP</a></h2>
|
||||
<p><a href="https://jpadilla.github.io/django-rest-framework-jsonp/">REST framework JSONP</a> provides JSONP rendering support. It was previously included directly in the REST framework package, and is now instead supported as a third-party package.</p>
|
||||
<hr />
|
||||
<p><strong>Warning</strong>: If you require cross-domain AJAX requests, you should generally be using the more modern approach of <a href="https://www.w3.org/TR/cors/">CORS</a> as an alternative to <code>JSONP</code>. See the <a href="https://www.django-rest-framework.org/topics/ajax-csrf-cors/">CORS documentation</a> for more details.</p>
|
||||
<div class="admonition warning">
|
||||
<p class="admonition-title">Warning</p>
|
||||
<p>If you require cross-domain AJAX requests, you should generally be using the more modern approach of <a href="https://www.w3.org/TR/cors/">CORS</a> as an alternative to <code>JSONP</code>. See the <a href="https://www.django-rest-framework.org/topics/ajax-csrf-cors/">CORS documentation</a> for more details.</p>
|
||||
<p>The <code>jsonp</code> approach is essentially a browser hack, and is <a href="https://stackoverflow.com/questions/613962/is-jsonp-safe-to-use">only appropriate for globally readable API endpoints</a>, where <code>GET</code> requests are unauthenticated and do not require any user permissions.</p>
|
||||
<hr />
|
||||
</div>
|
||||
<h4 id="installation-configuration_2"><a class="toclink" href="#installation-configuration_2">Installation & configuration</a></h4>
|
||||
<p>Install using pip.</p>
|
||||
<pre><code>$ pip install djangorestframework-jsonp
|
||||
|
|
|
|||
|
|
@ -534,7 +534,10 @@ router = DefaultRouter()
|
|||
router.register(r'users', UserViewSet, basename='user')
|
||||
urlpatterns = router.urls
|
||||
</code></pre>
|
||||
<p><strong>Warning</strong>: Do not use <code>.as_view()</code> with <code>@action</code> methods. It bypasses router setup and may ignore action settings like <code>permission_classes</code>. Use <code>DefaultRouter</code> for actions.</p>
|
||||
<div class="admonition warning">
|
||||
<p class="admonition-title">Warning</p>
|
||||
<p>Do not use <code>.as_view()</code> with <code>@action</code> methods. It bypasses router setup and may ignore action settings like <code>permission_classes</code>. Use <code>DefaultRouter</code> for actions.</p>
|
||||
</div>
|
||||
<p>Rather than writing your own viewsets, you'll often want to use the existing base classes that provide a default set of behavior. For example:</p>
|
||||
<pre><code>class UserViewSet(viewsets.ModelViewSet):
|
||||
"""
|
||||
|
|
|
|||
|
|
@ -452,4 +452,16 @@ ul.sponsor {
|
|||
margin: 0 -.6rem 1em;
|
||||
padding: 0.4rem 0.6rem;
|
||||
}
|
||||
.admonition.warning {
|
||||
border: .075rem solid #ff9844;
|
||||
}
|
||||
.admonition.warning .admonition-title {
|
||||
background: #ff98441a;
|
||||
}
|
||||
.admonition.danger {
|
||||
border: .075rem solid #f63a3a;
|
||||
}
|
||||
.admonition.danger .admonition-title {
|
||||
background: #f63a3a1a;
|
||||
}
|
||||
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
Loading…
Reference in New Issue
Block a user