A django LoginRequiredMixin that allows token authentication.

token.py

from django.contrib.auth import mixins
from rest_framework.authentication import SessionAuthentication
from rest_framework.authentication import TokenAuthentication
from rest_framework import generics

class TokenLoginRequiredMixin(mixins.LoginRequiredMixin):

    """A login required mixin that allows token authentication."""

    def dispatch(self, request, *args, **kwargs):
        """If token was provided, ignore authenticated status."""
        http_auth = request.META.get("HTTP_AUTHORIZATION")

        if http_auth and "Token" in http_auth:
            pass
          
        elif not request.user.is_authenticated:
            return self.handle_no_permission()

        return super(mixins.LoginRequiredMixin, self).dispatch(
            request, *args, **kwargs)
      
class ListAPIView(TokenLoginRequiredMixin, generics.ListAPIView):

    """This view suppot both token and session authentication."""
    
    authentication_classes = [
        SessionAuthentication,
        TokenAuthentication,
        ]

Thanks! It's a really useful snippet.

For usage with the GraphQL views: graphql-python/graphene#249 (comment)

If you are using generics.ListAPIView why would you need to override the token auth provided by authentication.TokenAuthentication? Also, is this only bypassing token validation? How is it secure? I'm a bit confused.