v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.py.drf.view-authentication-disabled

A DRF view disables authentication with an empty authentication_classes list.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Setting authentication_classes = [] on a view (or the @authentication_classes([]) decorator on a function view) turns off every authentication scheme for that endpoint, so request.user is always anonymous and any permission tied to an authenticated user cannot hold (CWE-306, OWASP A01:2021).

List the schemes the view should accept, for example authentication_classes = [TokenAuthentication], instead of emptying it.

VULNERABLE
vulnerable.py
from rest_framework.decorators import api_view, authentication_classes
from rest_framework.permissions import IsAuthenticated
from rest_framework.response import Response
from rest_framework.views import APIView


class PublicProfileView(APIView):
    # ruleid: auth.py.drf.view-authentication-disabled
    authentication_classes = []
    permission_classes = [IsAuthenticated]

    def get(self, request):
        return Response({"ok": True})


# ruleid: auth.py.drf.view-authentication-disabled
@api_view(["GET"])
@authentication_classes([])
def public_status(request):
    return Response({"ok": True})
SAFE
safe.py
from rest_framework.authentication import TokenAuthentication
from rest_framework.decorators import api_view, authentication_classes
from rest_framework.permissions import IsAuthenticated
from rest_framework.response import Response
from rest_framework.views import APIView


class AccountView(APIView):
    # ok: auth.py.drf.view-authentication-disabled -- populated with a real scheme
    authentication_classes = [TokenAuthentication]
    permission_classes = [IsAuthenticated]

    def get(self, request):
        return Response({"ok": True})


# ok: auth.py.drf.view-authentication-disabled -- decorator lists a real scheme
@api_view(["GET"])
@authentication_classes([TokenAuthentication])
def account_status(request):
    return Response({"ok": True})

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.drf.view-authentication-disabled -- <reason>

References

https://www.django-rest-framework.org/api-guide/views/#api_view ↗https://cwe.mitre.org/data/definitions/306.html ↗