title: Django Rest Framework - Using Session and Token Auth
body: <p>I am trying to get this working but don't know if this is possible. It should be doing it like this.</p>
  
  <p>I developed a web app using <code>Django</code> + <code>Rest-Framework</code> + <code>jQuery</code>, and I want to have an external application to consume the same <code>REST</code> API, using <code>JWT Tokens</code> for authentication.</p>
  
  <p>My current config is like this.</p>
  
  <p><strong>settings.py</strong></p>
  
  <pre><code>REST_FRAMEWORK = {
      'DEFAULT_AUTHENTICATION_CLASSES': [
          'rest_framework.authentication.SessionAuthentication',
          'rest_framework_simplejwt.authentication.JWTAuthentication',
      ],
      'DEFAULT_RENDERER_CLASS': [
          'rest_framework.renderers.JSONRenderer',
      ]
  }
  
  SIMPLE_JWT = {
      'AUTH_HEADER_TYPES': ('Bearer',),
      }
  </code></pre>
  
  <p><strong>views.py</strong></p>
  
  <pre><code>class ListFileView(APIView):
      permission_classes = (IsAuthenticated,)
  
      def get(self, request, *args, **kwargs):
          user = request.user
  
          if user:
  
              obj = Foo.objects.filter(owner=user)
              serializer = FooSerializer(obj, many=True)
              data = serializer.data
  
              return Response(data, status=status.HTTP_200_OK)
  
          return Response({'detail': 'You have no access to files.'}, status=status.HTTP_400_BAD_REQUEST)
  </code></pre>
  
  <p>The tricky part is that when I use:</p>
  
  <pre><code>permission_classes = (IsAuthenticated,)
  </code></pre>
  
  <p>I can perform <code>ajax</code> calls from an external application (using a valid <code>JWT</code> token), but <code>jQuery</code> calls from within the app (with an authenticated user) fail with:</p>
  
  <pre><code>{"detail":"Authentication credentials were not provided."}
  </code></pre>
  
  <p>And on the other hand, if I use <code>autentication_classes</code> instead of <code>permission_classes</code>:</p>
  
  <pre><code>authentication_classes = (SessionAuthentication, BasicAuthentication)
  </code></pre>
  
  <p>I can perform ajax calls from within the web app using <code>jQuery</code>, but external calls fail with the same <code>403</code> error.</p>
  
  <p>I tried using both like this:</p>
  
  <pre><code>class ListFileView(APIView):
      authentication_classes = (SessionAuthentication, BasicAuthentication)
      permission_classes = (IsAuthenticated,)
  
      def get(self, request, *args, **kwargs):
          ...
  </code></pre>
  
  <p>but the external calls are also rejected.</p>
  
  <p>Is it possible to have these two types of <code>Auth</code> working together in the same <code>class</code> view, or should I separate into two endpoints?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>Example calls from within the app with <code>jQuery</code>:</p>
  
  <pre><code>&lt;script type="text/javascript"&gt;
  
  function loadTblDocs() {
    $("#tbl-docs &gt; tbody").empty();
  
    $.ajaxSetup({
        headers: { "X-CSRFToken": '{{csrf_token}}' }
      });
  
    $.ajax({
      type: 'GET',
      contentType: "application/json; charset=utf-8",
      url: "/api/list/",
      dataType: "json",
      success: function (data) {
                  console.log(data);
                  }
      });
  };
  
  &lt;/script&gt;
  </code></pre>
  
  <p>And externally via <code>VBA</code> code:</p>
  
  <pre><code>Set web = CreateObject("WinHttp.WinHttpRequest.5.1")
  web.Open "GET", "/api/list/", False
  web.SetRequestHeader "Authorization", "Bearer &lt;JWT_TOKEN_HERE&gt;"
  web.Send
  </code></pre>