Session Authentication

rest_framework/renderers.py

@@ -801,7 +801,7 @@ class DocumentationRenderer(BaseRenderer):
     template = 'rest_framework/docs/index.html'
     code_style = 'emacs'
 
-    def get_context(self, data):
+    def get_context(self, data, request):
         from pygments.formatters import HtmlFormatter
         from django.utils.html import mark_safe
         formatter = HtmlFormatter(style=self.code_style)
@@ -813,12 +813,13 @@ class DocumentationRenderer(BaseRenderer):
             'document': data,
             'langs': langs,
             'code_style': code_style,
-            'schema': schema
+            'schema': schema,
+            'request': request
         }
 
     def render(self, data, accepted_media_type=None, renderer_context=None):
         template = loader.get_template(self.template)
-        context = self.get_context(data)
+        context = self.get_context(data, renderer_context['request'])
         return template_render(template, context, request=renderer_context['request'])
 
 

rest_framework/templates/rest_framework/docs/auth/session.html

@@ -0,0 +1,35 @@
+{% load rest_framework %}
+
+<!-- Modal -->
+<div class="modal fade auth-modal auth-session" id="auth_session_modal" tabindex="-1" role="dialog" aria-labelledby="session authentication modal">
+<div class="modal-dialog modal-md" role="document">
+  <div class="modal-content">
+    <div class="modal-header">
+      <h3 class="modal-title"><i class="fa fa-key"></i> Session Authentication</h3>
+    </div>
+
+    <form class="form-horizontal authentication-session-form">
+    <div class="modal-body">
+
+        {% if user.is_authenticated %}
+          <h4 class="text-center">You are logged in as {{ user.username }}.</h4>
+        {% else %}
+
+          <div class="text-center">
+            <h4 class="text-center">You need to {% optional_docs_login request %} to enable Session Authentication.</h4>
+          </div>
+        {% endif %}
+
+    </div>
+
+    <div class="modal-footer">
+      <button type="button" class="btn btn-default" data-dismiss="modal">Close</button>
+      {% if user.is_authenticated %}
+        <button type="submit" class="btn btn-primary">Use Session Authentication</button>
+      {% endif %}
+    </div>
+    </form>
+
+  </div>
+</div>
+</div>

rest_framework/templates/rest_framework/docs/auth/token.html

@@ -8,13 +8,13 @@
       <h3 class="modal-title"><i class="fa fa-key"></i> Authentication Token</h3>
     </div>
 
-    <form class="form-horizontal authentication-form">
+    <form class="form-horizontal authentication-token-form">
     <div class="modal-body">
       <div class="form-group">
         <label for="authorization" class="col-sm-2 control-label">Authorization:</label>
 
         <div class="col-sm-10">
-          <input type="text" class="form-control" id="authorization" placeholder="Bearer XXXX-XXXX-XXXX-XXXX" aria-describedby="helpBlock">
+          <input type="text" class="form-control" id="authorization" placeholder="Bearer XXXX-XXXX-XXXX-XXXX" aria-describedby="helpBlock" required>
           <span id="helpBlock" class="help-block">The value to include for the <code>Authorization</code> header in outgoing HTTP requests.</span>
         </div>
       </div>
@@ -22,7 +22,7 @@
 
     <div class="modal-footer">
       <button type="button" class="btn btn-default" data-dismiss="modal">Close</button>
-      <button type="submit" class="btn btn-primary">Submit</button>
+      <button type="submit" class="btn btn-primary">Use Token Authentication</button>
     </div>
     </form>
 

rest_framework/templates/rest_framework/docs/index.html

@@ -40,6 +40,7 @@
         </div>
 
         {% include "rest_framework/docs/auth/token.html" %}
+        {% include "rest_framework/docs/auth/session.html" %}
 
         <script src="{% static 'rest_framework/docs/js/jquery-1.10.2.min.js' %}"></script>
         <script src="{% static 'rest_framework/docs/js/bootstrap.min.js' %}"></script>
@@ -183,6 +184,10 @@
                     options.headers = {
                         'Authorization': window.auth.value
                     }
+                } else if (window.auth && window.auth.type === 'session') {
+                    options.csrf = {
+                        'X-CSRFToken': getCookie('csrftoken')
+                    }
                 }
 
                 const client = new coreapi.Client(options)
@@ -214,35 +219,41 @@
                 }
             });
 
-            $('form.authentication-form').submit(function(event) {
+            // Authentication: none
-                event.preventDefault();
-                const form = $(this).closest("form");
-                const value = form.find('input').val();
-                $('#auth_token_modal').modal('hide');
-
-                $('#auth-control').children().removeClass('active');
-
-                if (value) {
-                    window.auth = {
-                        'type': 'token',
-                        'value': value,
-                    };
-                    $('#selected-authentication').text('token');
-                    $('#auth-control').find("[data-auth='token']").addClass('active');
-                } else {
-                    window.auth = null;
-                    $('#selected-authentication').text('none');
-                    $('#auth-control').find("[data-auth='none']").addClass('active');
-                }
-            });
-
             $('#auth-control').find("[data-auth='none']").click(function (event) {
                 event.preventDefault();
                 window.auth = null;
                 $('#selected-authentication').text('none');
+                $('#auth-control').children().removeClass('active');
                 $('#auth-control').find("[data-auth='none']").addClass('active');
-                $('#auth-control').find("[data-auth='token']").removeClass('active');
             })
+
+            // Authentication: token
+            $('form.authentication-token-form').submit(function(event) {
+                event.preventDefault();
+                const form = $(this).closest("form");
+                const value = form.find('input').val();
+                window.auth = {
+                    'type': 'token',
+                    'value': value,
+                };
+                $('#selected-authentication').text('token');
+                $('#auth-control').children().removeClass('active');
+                $('#auth-control').find("[data-auth='token']").addClass('active');
+                $('#auth_token_modal').modal('hide');
+            });
+
+            // Authentication: session
+            $('form.authentication-session-form').submit(function(event) {
+                event.preventDefault();
+                window.auth = {
+                    'type': 'session',
+                };
+                $('#selected-authentication').text('session');
+                $('#auth-control').children().removeClass('active');
+                $('#auth-control').find("[data-auth='session']").addClass('active');
+                $('#auth_session_modal').modal('hide');
+            });
         </script>
     </body>
 </html>

rest_framework/templates/rest_framework/docs/sidebar.html

@@ -23,6 +23,7 @@
             <ul class="sub-menu collapse out" id="auth-control">
                 <li data-auth="none" class="active"><a href="#" data-language="none">none</a></li>
                 <li data-auth="token" data-toggle="modal" data-target="#auth_token_modal"><a href="#">token</a></li>
+                <li data-auth="session" data-toggle="modal" data-target="#auth_session_modal"><a href="#">session</a></li>
             </ul>
 
             <li data-toggle="collapse" data-target="#language-control" class="collapsed">

rest_framework/templatetags/rest_framework.py

@@ -128,6 +128,22 @@ def optional_login(request):
     return mark_safe(snippet)
 
 
+@register.simple_tag
+def optional_docs_login(request):
+    """
+    Include a login snippet if REST framework's login view is in the URLconf.
+    """
+    try:
+        login_url = reverse('rest_framework:login')
+    except NoReverseMatch:
+        return 'log in'
+
+    snippet = "<a href='{href}?next={next}'>log in</a>"
+    snippet = format_html(snippet, href=login_url, next=escape(request.path))
+
+    return mark_safe(snippet)
+
+
 @register.simple_tag
 def optional_logout(request, user):
     """