DRF django-rest-framework-simplejwt JWTAuthentication not working

Question

Ideally using django-rest-framework-simplejwt and the authentication class JWTAuthentication, the API should give 403 when I pass the token incorrectly.

Instead, when I am making my API request it is executing successfully even without the Authentication token.

This is a dummy API, my concern is the Authentication should work.

My code looks like this:

class ViewSet(viewsets.ModelViewSet):
    queryset = get_user_model().objects.all()
    serializer_class = SomeSerializer
    http_method_names = ("post", "patch")
    authentication_classes = (JWTAuthentication,)

When I debug I see that it is executing JWTAuthentication, which in turn returns None. Which is expected since I am not passing the Token in the header.

    def authenticate(self, request):
        header = self.get_header(request)
        if header is None:
            return None

Now I think the View should give Permission Denied, which is not happening.

Not able to understand what is missing here.

Answer 1

If you pass incorrect token, it'll return 401 status response.
But if you don't put authorization header on your request, django will not return 401 response and behave with request as AnonymousUser request. If you want only authenticated users have access to your ViewSet, you should put permission_classes = [IsAuthenticated,] in your ViewSet.

IsAuthenticated permission class can be imported from rest_framework.permissions