Repository: paperless-ngx/paperless-ngx

Issue:
[BUG] API token request unusable when using PAPERLESS_AUTO_LOGIN_USERNAME
### Description

When I enable the auto login feature, some of the requests to the API return 403 with `{"detail":"CSRF Failed: CSRF cookie not set."}`. I cannot say for sure, but if feels like any request that would modify data fails this way.

### Steps to reproduce

`docker-compose.yml`
```yaml
version: "3.4"
services:
  paperless:
    image: ghcr.io/paperless-ngx/paperless-ngx:2.1.3
    restart: unless-stopped
    depends_on:
      - redis
    environment:
      PAPERLESS_ADMIN_MAIL: johannes@plunien.com
      PAPERLESS_ADMIN_PASSWORD: secret
      PAPERLESS_ADMIN_USER: admin
      PAPERLESS_REDIS: redis://redis:6379
      PAPERLESS_AUTO_LOGIN_USERNAME: admin
    ports:
      - "8000:8000"
  redis:
    image: docker.io/library/redis:7
    restart: unless-stopped
```

Steps to reproduce:
```shell
# SUCCESS
curl 'http://localhost:8000/api/correspondents/'
# FAILURE
curl -XPOST -H "Content-Type: application/json" --data-binary '{"matching_algorithm": 6, "name": "Test"}' 'http://localhost:8000/api/correspondents/'
```

### Webserver logs

```bash
[2023-12-23 09:42:45,270] [WARNING] [django.request] Forbidden: /api/correspondents/
```


### Browser logs

_No response_

### Paperless-ngx version

2.1.3

### Host OS

docker

### Installation method

Docker - official image

### Browser

_No response_

### Configuration changes

_No response_

### Other

_No response_

### Please confirm the following

- [X] I believe this issue is a bug that affects all users of Paperless-ngx, not something specific to my installation.
- [X] I have already searched for relevant existing issues and discussions before opening this report.
- [X] I have updated the title field above with a concise description.


Discussion:
I find that setting to be odd, TBH I wonder if we should just remove it. Anyway, this works fine with the app itself, so Im not sure why we need to ensure it works when hitting the API directly? There are already normal ways to authenticate with the API. By using this setting youre essentially faking Session auth, which does need csrf. Normal API use uses the token, which doesnt.

If anyone thinks differently, please feel free to correct me here.
There seem to be users using this feature, so not sure about just removing it. How difficult would it be to just fix `POST /api/token/`? Or exclude `/api/` from this setting?
I don’t think it’s that simple in general but hmm, for the token endpoint maybe. Is that the real issue here for you?

Resolving patch:
diff --git a/src/paperless/auth.py b/src/paperless/auth.py
--- a/src/paperless/auth.py
+++ b/src/paperless/auth.py
@@ -2,12 +2,16 @@
 from django.contrib import auth
 from django.contrib.auth.middleware import PersistentRemoteUserMiddleware
 from django.contrib.auth.models import User
+from django.http import HttpRequest
 from django.utils.deprecation import MiddlewareMixin
 from rest_framework import authentication
 
 
 class AutoLoginMiddleware(MiddlewareMixin):
-    def process_request(self, request):
+    def process_request(self, request: HttpRequest):
+        # Dont use auto-login with token request
+        if request.path.startswith("/api/token/") and request.method == "POST":
+            return None
         try:
             request.user = User.objects.get(username=settings.AUTO_LOGIN_USERNAME)
             auth.login(
diff --git a/src/paperless/settings.py b/src/paperless/settings.py
--- a/src/paperless/settings.py
+++ b/src/paperless/settings.py
@@ -297,8 +297,8 @@ def _parse_beat_schedule() -> dict:
 REST_FRAMEWORK = {
     "DEFAULT_AUTHENTICATION_CLASSES": [
         "rest_framework.authentication.BasicAuthentication",
-        "rest_framework.authentication.SessionAuthentication",
         "rest_framework.authentication.TokenAuthentication",
+        "rest_framework.authentication.SessionAuthentication",
     ],
     "DEFAULT_VERSIONING_CLASS": "rest_framework.versioning.AcceptHeaderVersioning",
     "DEFAULT_VERSION": "1",


Test patch: