title: Is this view in django secure?
body: <p>I am building a RESTAPI in Django using the following <a href="https://github.com/ronhe/drf-firebase-token-auth" rel="nofollow noreferrer">library</a> called drf-firebase-token-auth. The client sends a get request with the token_id available in the Authorization header, and the library is expected to handle authentication in Firebase automatically.</p>
  <p>But the problem is if I do a simple get request without headers like <code>curl &lt;url+endpoint&gt;</code> the library doesn't verify if there's a an Authorization header and try to get a token for verification as if the request happens successfully as if drf-firebase-token-auth didn't raised it to be a problem. So I handled an exception whereas if the get request doesn't have an an authorization header, then raise an exception. But is it secure?</p>
  <pre><code>from datetime import datetime
  from rest_framework import status
  from rest_framework.decorators import (
      api_view,
  )
  from rest_framework.response import Response
  
  
  
  # Create your views here.
  
  
  @api_view([&quot;GET&quot;])
  def check_token(request):
      # if token is valid response with current server time
      try:
  
          if request.META[&quot;HTTP_AUTHORIZATION&quot;]:
              date = datetime.now()
              return Response(
                  data=&quot;Server time is: &quot; + str(date), status=status.HTTP_200_OK
              )
      
      except:
          return Response(data=&quot;Authorization header unavailable&quot;)
  </code></pre>