Do not require authentication for GET requests from browser
Question: This question is closely related to [Do not require authentication for OPTIONS
requests](http://stackoverflow.com/questions/31274810/do-not-require-
authentication-for-options-requests)

My settings.py

    
    
    REST_FRAMEWORK = {
        'UNICODE_JSON': True,
        'NON_FIELD_ERRORS_KEY': '__all__',
        'DEFAULT_AUTHENTICATION_CLASSES': (
            'rest_framework.authentication.TokenAuthentication',
        ),
        'DEFAULT_PERMISSION_CLASSES': (
            'platformt_core.something.permissions.DjangoObjectPermissionsOrOptions',
        ),
        'DEFAULT_RENDERER_CLASSES': (
            'rest_framework.renderers.JSONRenderer',
        ),
        'ALLOWED_VERSIONS': ['v1'],
        'DEFAULT_VERSIONING_CLASS': 'rest_framework.versioning.NamespaceVersioning',
        'TEST_REQUEST_DEFAULT_FORMAT': 'json',
        'TEST_REQUEST_RENDERER_CLASSES': (
            'rest_framework.renderers.JSONRenderer',
        )
    }
    

platformt_core/something/permissions.py

    
    
    from rest_framework.permissions import DjangoObjectPermissions
    
    OPTIONS_METHOD = 'OPTIONS'
    
    class DjangoObjectPermissionsOrOptions(DjangoObjectPermissions):
        def has_permission(self, request, view):
            if request.method == OPTIONS_METHOD:
                return True
            else:
                return super(DjangoObjectPermissions, self).has_permission(request, view)
    

When I do this request from browser:

    
    
    GET /api/passenger/v1/order/ HTTP/1.1
    Host: 127.0.0.1:8000
    Connection: keep-alive
    Cache-Control: max-age=0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36
    Accept-Encoding: gzip, deflate, sdch
    Accept-Language: en-US,en;q=0.8
    Cookie: csrftoken=3XytVl8Oh2PJxcSs1ufI9TIZMOTC5Pix
    

I expect something neat like "Self describing APIs" described at
<http://www.django-rest-framework.org/topics/documenting-your-api/>

But instead I get:

    
    
    HTTP/1.0 401 UNAUTHORIZED
    Date: Wed, 08 Jul 2015 20:45:23 GMT
    Server: WSGIServer/0.1 Python/2.7.6
    Content-Type: application/json;q=0.8; charset=utf-8
    WWW-Authenticate: Token
    Allow: POST, OPTIONS
    
    {"detail":"Authentication credentials were not provided."}
    

Is there a neat way to achieve that? I mean I would like have browseable API,
but API requests should be still secured with authentication.


Answer: Can't you just use?

    
    
    'DEFAULT_PERMISSION_CLASSES': ('rest_framework.permissions.IsAuthenticatedOrReadOnly',)
    

This will allow read-only access to unauthenticated users.

