title: In django-rest-framework, is it possible to use oauth and session authentication simultaneously?
body: <p>Here's what I'm trying to do: I'm building a finance app. There's a web component, which is using Django templates and jQuery for AJAX requests, and a mobile client.</p>
  
  <p>My goal is to use session-based authentication for the AJAX requests coming from the web app, using django-allauth for authentication, and OAUTH2 for the mobile app with django-oauth-toolkit. I'm using django-rest-framework for the endpoints.</p>
  
  <p>The AJAX behaviour was working fine before I added the OAUTH middleware/authentication backend. This code from my <code>view.py</code> now prompts a 401 unauthorized when accessed via AJAX call, even when the user is authenticated using django-allauth. It worked previously (and still works when accessed via curl with an access token):</p>
  
  <pre><code>@api_view(['GET'])
  def portfolio(request):
      """
      Get account balances, total portfolio value in CAD, and balances converted to CAD at current market rates.
      """
      try:
          account = request.user.account
      except ObjectDoesNotExist:
          return Response(status=Status.HTTP_404_NOT_FOUND)
  
      if request.method == 'GET':
          serializer = AccountSerializer(account)
          return Response(serializer.data)
  </code></pre>
  
  <p>Here are the relevant bits of my<code>settings.py</code>:</p>
  
  <pre><code>MIDDLEWARE = [
      'django.contrib.sessions.middleware.SessionMiddleware',
      'django.contrib.auth.middleware.AuthenticationMiddleware',
      'oauth2_provider.middleware.OAuth2TokenMiddleware',
      'corsheaders.middleware.CorsMiddleware',
      'django.middleware.security.SecurityMiddleware',
      'whitenoise.middleware.WhiteNoiseMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.middleware.csrf.CsrfViewMiddleware',
      'django_otp.middleware.OTPMiddleware',
      'django.contrib.messages.middleware.MessageMiddleware',
      'django.middleware.clickjacking.XFrameOptionsMiddleware',
  ]
  
  AUTHENTICATION_BACKENDS = (
      'allauth.account.auth_backends.AuthenticationBackend',
      'django.contrib.auth.backends.ModelBackend',
      'oauth2_provider.backends.OAuth2Backend',
  )
  </code></pre>
  
  <p>An older method I wrote that doesn't use django-rest still works fine:</p>
  
  <pre><code>@verified_account_required
  def get_rates(request):
      if request.method == 'POST':
          buy_rates,sell_rates = utility_rates()
  
          if request.POST.get('action') == 'buy':
              data = buy_rates
          else:
              data = sell_rates
  
          return JsonResponse(data)
  </code></pre>
  
  <p>How can I use Django-rest with both authentication types simultaneously? Or is that not possible?</p>
  
  <p>I am, admittedly, quite new to Django - so there is probably something I am just not understanding correctly here.</p>