search

manosim / django-rest-framework-api-key

An extra layer of authentication for Web APIs made with Django REST Framework
BSD 2-Clause "Simplified" License
92 stars 30 forks source link

always grants permission if HTTP_API_KEY not supplied #5

Closed ggilley closed 7 years ago

ggilley commented 7 years ago

is HasAPIAccess, you should make sure that api_key is not None. Otherwise, if you don't pass in an api key, permission is always granted.

You can verify the failure by changing test_admin.py to pass in 'HTTP_WRONG_API_KEY' instead of 'HTTP_API_KEY'.

ggilley commented 7 years ago

Hmm... It seems to work correctly. Maybe it only happens if you have an empty table?