Changed behavior for the /api/ request #9747

Closed
opened 2025-12-29 21:22:00 +01:00 by adam · 1 comment
Owner

Originally created by @VitMain on GitHub (May 25, 2024).

Deployment Type

Self-hosted

NetBox Version

4.0.3

Python Version

3.10

Steps to Reproduce

configuration.py
LOGIN_REQUIRED = True

In version 3.7.8, unauthenticated request to the API return 200 and response with endpoints:
Request:
GET /api/ HTTP/1.1

Response:
{
"circuits": "https://somehost/api/circuits/",
"core": "https://somehost/api/core/",
"dcim": "https://somehost/api/dcim/",
"extras": "https://somehost/api/extras/",
"ipam": "https://somehost/api/ipam/",
"plugins": "https://somehost/api/plugins/",
"status": "https://somehost/api/status/",
"tenancy": "https://somehost/api/tenancy/",
"users": "https://somehost/api/users/",
"virtualization": "https://somehost/api/virtualization/",
"vpn": "https://somehost/api/vpn/",
"wireless": "https://somehost/api/wireless/"
}

In version 4.0.3, unauthenticated request to the API return 403 and
Request:
GET /api/ HTTP/1.1

Response:
{
"detail": "Authentication credentials were not provided."
}

Changing LOGIN_REQUIRED = False returns old behavior

Not sure that a bug, may be right now it's a correct behavior.

Expected Behavior

Expected response with the endpoints (?)

Observed Behavior

Please check reproduce.

Originally created by @VitMain on GitHub (May 25, 2024). ### Deployment Type Self-hosted ### NetBox Version 4.0.3 ### Python Version 3.10 ### Steps to Reproduce configuration.py LOGIN_REQUIRED = True In version 3.7.8, unauthenticated request to the API return 200 and response with endpoints: Request: GET /api/ HTTP/1.1 Response: { "circuits": "https://somehost/api/circuits/", "core": "https://somehost/api/core/", "dcim": "https://somehost/api/dcim/", "extras": "https://somehost/api/extras/", "ipam": "https://somehost/api/ipam/", "plugins": "https://somehost/api/plugins/", "status": "https://somehost/api/status/", "tenancy": "https://somehost/api/tenancy/", "users": "https://somehost/api/users/", "virtualization": "https://somehost/api/virtualization/", "vpn": "https://somehost/api/vpn/", "wireless": "https://somehost/api/wireless/" } In version 4.0.3, unauthenticated request to the API return 403 and Request: GET /api/ HTTP/1.1 Response: { "detail": "Authentication credentials were not provided." } Changing LOGIN_REQUIRED = False returns old behavior Not sure that a bug, may be right now it's a correct behavior. ### Expected Behavior Expected response with the endpoints (?) ### Observed Behavior Please check reproduce.
adam added the type: bug label 2025-12-29 21:22:00 +01:00
adam closed this issue 2025-12-29 21:22:01 +01:00
Author
Owner

@arthanson commented on GitHub (May 29, 2024):

We think this was probably caused by a large change to the underlying Django REST framework. This is actually more correct behavior, but worth calling out in the release notes. I've opened a doc issue to track this #16352. Thanks for bringing this to our attention, closing out this issue in favor of the doc update.

@arthanson commented on GitHub (May 29, 2024): We think this was probably caused by a large change to the underlying Django REST framework. This is actually more correct behavior, but worth calling out in the release notes. I've opened a doc issue to track this #16352. Thanks for bringing this to our attention, closing out this issue in favor of the doc update.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#9747