Just to clarify - 401 is connected to HTTP Authentication, not to the authentication in general. Therefore if e.g. UserLoggedInAuthentication is used and the test fails, 403 is the proper response.

Where does the 401 Error should be used then?

I found it convenient to differentiate permissions from authorization for my client side. I think that what is also done in django-tastypie.

@sebastibe: Take a look here: http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2

"The request requires user authentication." Yes I read this when I proposed my patch.

To precise my question: Where in django-rest-framework the 401 should be raised? Because for the moment it is raised nowhere.

@sebastibe: I don't know where 401 belongs in django-rest-framework. I only wanted to promote good practices regarding HTTP status codes :)

Whilst I acknowledge that the 401 spec does mention Basic Auth, the 403 spec says "Authorization will not help", which in this case is clearly not true. So neither fits exactly, and I think 401 is a closer fit.

@mjtamlyn "Authorization will not help" relates to "401 Unauthorized"

http://stackoverflow.com/questions/6113014/what-http-code-to-use-in-not-authenticated-and-not-authorized-cases

If anyone is interested in tackling this I've sketched out what I think need to happen to do this properly.
Would really appreciate any help, along the lines of:

• I write the docs.
• You implement the code and tests.

Anyone fancy helping?....

Updated title to better reflect the work that needs to be done.

Written the docs for this in unauthenticated-response branch

What needs to happen now...

• Request._authenticate should set a boolean flag on the request depending on if it was authenticated or not.
• view.permission_denied should raise either Unauthenticated or PermissionDenied depending on that flag.
• View.handle_exception should catch Unauthenticated responses, and call the .authenticate_header() method on the first authentication scheme to determine if a 401 or 403 should be returned.

Note also that I've split out AuthenticationFailed and NotAuthenticated exceptions.