Say you want to keep your API secure and thus it has authentication, but there's this one View action in a ViewSet which unlike the rest of the ViewSet's actions needs to allow free access without authentication.
This solution applies the good old `IsAuthenticated` permission to all ViewSet actions except those defined in a `login_exempt_actions` list. That's a list of the ViewSet action's names.
This is a simple solution for this particular problem, which I imagine could be quite common.
Any case where the requirements are more complex should implement one of the DRF permissions extensions which allow for the use of logical operators.
**NOTE**: Remember that `request.user` will be an `AnonymousUser` instance, so be careful with any code which assumes it'll be a `User` instance. This could be the case with, say, a custom `get_queryset` implementation.
- authentication
- api
- django-rest-framework