Add DRFSessionAuthentication401Middleware

django_utils_lib/middleware.py

@@ -88,3 +88,21 @@ def __call__(self, request: HttpRequest) -> HttpResponse:
                 response["Location"] = redirect_url.geturl()
 
         return response
+
+
+try:
+    from rest_framework.authentication import SessionAuthentication
+    from rest_framework.request import Request as DRFRequest
+
+    class DRFSessionAuthentication401Middleware(SessionAuthentication):
+        """
+        Small shim around DRF's SessionAuthentication, so it returns 401s for
+        unauthorized, instead of 403.
+
+        https://github.com/encode/django-rest-framework/issues/5968
+        """
+
+        def authenticate_header(self, request: DRFRequest):
+            return "Session"
+except ImportError:
+    pass

pyproject.toml

@@ -25,6 +25,8 @@ pytest-playwright = "^0.5.2"
 filelock = "^3.16.0"
 debugpy = "^1.8.5"
 django = "*"
+djangorestframework = "^3.15.2"
+djangorestframework-stubs = {extras = ["compatible-mypy"], version = "^3.15.2"}
 
 [tool.ruff]
 line-length = 120