access_token on URL causes half-authenticated users

[sybrenstuvel]

Testing with Django 1.11.9 and django-oauth-toolkit 1.1.0, I get strange results when passing access_token=xxxx as query string on a GET request. This is my view:

from django.http import JsonResponse
from oauth2_provider.decorators import protected_resource


@protected_resource()
def demo_view(request):
    return JsonResponse({'user': str(request.user)})

Taking a valid access token, I can GET the URL, get through the protected_resource() decorator, but it doesn't properly set request.user:

$ curl  http://localhost:8000/api/demo?access_token=ByEMH9CNNW0Tq8nONBaNcQATdh2u9v 
{"user": "AnonymousUser"}

So then we have a strange hybrid of having properly authenticated a user, but still the view code not knowing anything about this.

This may be related to #533.

[ljluestc]

To address this issue, you can manually authenticate the user using the provided access token inside your view function. Here's how you can do it:

from django.http import JsonResponse
from oauth2_provider.views.decorators import protected_resource

@protected_resource()
def demo_view(request):
    if request.user.is_anonymous:
        # Attempt to authenticate the user using the access token
        if request.GET.get("access_token"):
            from oauthlib.oauth2.rfc6749.tokens import BearerToken
            token = request.GET.get("access_token")
            auth_server, token = BearerToken().authenticate_token(token)
            if auth_server and auth_server.is_usable_token(token):
                request.user = auth_server.get_user_for_token(token)

    return JsonResponse({'user': str(request.user)})

By manually checking for the presence of the access_token in the query string and authenticating the user using BearerToken().authenticate_token(token), you ensure that the request.user is correctly set based on the access token provided.

Please note that manually handling token authentication may not be the most elegant solution, but it should work as a workaround until the issue is addressed in a future version of django-oauth-toolkit.

Additionally, you might want to consider upgrading to the latest version of Django and django-oauth-toolkit if possible, as newer versions might have addressed this issue or provided a more straightforward solution for token authentication.