v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.py.drf.default-authentication-empty

DRF disables authentication globally with an empty DEFAULT_AUTHENTICATION_CLASSES list.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

An empty list means no authentication scheme runs, so request.user is never populated from a credential and every view falls back to anonymous access (CWE-306, OWASP A01:2021). Permission checks that rely on request.user being authenticated then have nothing to enforce against.

Populate the list with the schemes you use, for example rest_framework.authentication.SessionAuthentication and rest_framework.authentication.TokenAuthentication.

VULNERABLE
vulnerable.py
# ruleid: auth.py.drf.default-authentication-empty
REST_FRAMEWORK = {
    "DEFAULT_AUTHENTICATION_CLASSES": [],
    "DEFAULT_PERMISSION_CLASSES": [
        "rest_framework.permissions.IsAuthenticated",
    ],
}
SAFE
safe.py
# ok: auth.py.drf.default-authentication-empty -- populated with real schemes
REST_FRAMEWORK = {
    "DEFAULT_AUTHENTICATION_CLASSES": [
        "rest_framework.authentication.SessionAuthentication",
        "rest_framework.authentication.TokenAuthentication",
    ],
    "DEFAULT_PERMISSION_CLASSES": [
        "rest_framework.permissions.IsAuthenticated",
    ],
}


# ok: auth.py.drf.default-authentication-empty -- key absent, DRF default schemes apply
REST_FRAMEWORK = {
    "DEFAULT_PERMISSION_CLASSES": [
        "rest_framework.permissions.IsAuthenticated",
    ],
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.drf.default-authentication-empty -- <reason>

References

https://www.django-rest-framework.org/api-guide/authentication/#setting-the-authentication-scheme ↗https://cwe.mitre.org/data/definitions/306.html ↗