How to disable admin-style browsable interface of django-rest-framework?

ID : 20241

viewed : 15

Tags : djangodjango-rest-frameworkdjango

Top 5 Answer for How to disable admin-style browsable interface of django-rest-framework?

vote vote


You just need to remove the browsable API renderer from your list of supported renderers for the view.


REST_FRAMEWORK = {     'DEFAULT_RENDERER_CLASSES': (         'rest_framework.renderers.JSONRenderer',     ) } 

Per-view basis:

class MyView(...):     renderer_classes = [renderers.JSONRenderer] 


In many cases I think it's a shame that folks would choose to disable the browsable API in any case, as it's a big aid to any developers working on the API, and it doesn't give them more permissions that they would otherwise have. I can see that there might be business reasons for doing so in some cases, but generally I'd consider it a huge asset. Although, in some cases there may be details shown (like the names of custom actions) that a non-public API may not want to expose.

See also the answer below for more detail about restricting the browsable API renderer to development.

vote vote


While the accepted answer to this question does answer the question as it was worded, I feel that it does not solve the actual issue at hand.

For completeness in this answer, disabling the browseable HTML api is done by removing it from the renderer classes like so:

REST_FRAMEWORK = {     'DEFAULT_RENDERER_CLASSES': (         'rest_framework.renderers.JSONRenderer',     ) } 

However, the actual issue the question alludes to is people being able to post to the API without authentication. While removing the form makes it less obvious, this answer does not protect the API endpoints.

At minimum, someone finds this question and is looking to protect the API from unauthenticated, or unauthorised POST submissions; the are looking to change the API Permissions

The following will set all endpoints to be read only unless the user is authenticated.

REST_FRAMEWORK = {     'DEFAULT_PERMISSION_CLASSES': (         'rest_framework.permissions.IsAuthenticatedOrReadOnly',     ) } 

If you would like to completely hide the API unless the user is logged in, you could also use IsAuthenticated.

FYI: This will also remove the form from the HTML browseable API as it responds to permissions. When an authenticated user logs in, the form will be available again.

Bonus Round:

Only enable the browseable HTML API in dev:

DEFAULT_RENDERER_CLASSES = (     'rest_framework.renderers.JSONRenderer', )  if DEBUG:     DEFAULT_RENDERER_CLASSES = DEFAULT_RENDERER_CLASSES + (         'rest_framework.renderers.BrowsableAPIRenderer',     )  REST_FRAMEWORK = {     'DEFAULT_PERMISSION_CLASSES': (         'rest_framework.permissions.IsAuthenticatedOrReadOnly',     ),     'DEFAULT_RENDERER_CLASSES': DEFAULT_RENDERER_CLASSES } 
vote vote


 # For Production Only  REST_FRAMEWORK = {      'DEFAULT_RENDERER_CLASSES': (          'rest_framework.renderers.JSONRenderer',      )  } 

Just Add this to your should disable the Browsable API!

vote vote


#include <stdio.h>  /* defines FILENAME_MAX */ //#define WINDOWS  /* uncomment this line to use it for windows.*/ #ifdef WINDOWS #include <direct.h> #define GetCurrentDir _getcwd #else #include <unistd.h> #define GetCurrentDir getcwd #endif  int main(){   char buff[FILENAME_MAX];   GetCurrentDir( buff, FILENAME_MAX );   printf("Current working dir: %s\n", buff);   return 1; } 
vote vote


Note that getcwd(3) is also available in Microsoft's libc: getcwd(3), and works the same way you'd expect.

Must link with -loldnames (oldnames.lib, which is done automatically in most cases), or use _getcwd(). The unprefixed version is unavailable under Windows RT.

Top 3 video Explaining How to disable admin-style browsable interface of django-rest-framework?