tomchristie/django-rest-framework — pull request #1611 by dbrgn (2014-06-01 22:49:12+00:00)
Title: Authenticate header loop

When trying to determine the `WWW-Authenticate` header (https://github.com/tomchristie/django-rest-framework/blob/12394c9cacef0c92ef5b9d31836612e52a26e57a/rest_framework/views.py#L144-L151), until now the first available authentication class is used. If it doesn't provide any header (see the `SessionAuthentication` class as an example), `None` is returned, even though there might be another authentication class which does provide a valid header.

With this commit, `get_authenticate_header()` iterates through all available authentication classes, until it finds one that provides a valid header (if any).

A use case where the current behavior is a problem is the default configuration:

```python
'DEFAULT_AUTHENTICATION_CLASSES': (
'rest_framework.authentication.SessionAuthentication',
'rest_framework.authentication.BasicAuthentication',
),
```

Even though basic auth provides a valid `WWW-Authenticate` header, a HTTP 403 status is returned when a permission check fails.

Tests to cover this change are provided in this PR.

(The fix in the first commit is needed to properly pass the tests after the second commit has been added.)