Logout view change permission_classes

Shouldn’t the LogoutView have permission_classes set to permission_classes = (IsAuthenticated,) instead of permission_classes = (AllowAny,) , regardless of GET/POST method ?

• in addition in the logout function:

 def logout(self, request):
    try:
            request.user.auth_token.delete()
      except (AttributeError, ObjectDoesNotExist):
            pass

should be changed to

   def logout(self, request):
        try:
            request.user.auth_token.delete()
        except (AttributeError, ObjectDoesNotExist):
            # handle NotAuthenticated

[NikosVlagoidis]

It is a bit confusing for the developer perspective as you test at first and it’s not so clear as a response to say: “detail”: “Successfully logged out.” when actually nothing happened. I think it is an easy fix.

[shaklev]

Hey @Akay7 @maxim-kht ,

I was looking from the perspective of “the correct response for every API call” but since the view doesn’t return any sensitive data , a valid argument is that it doesn’t have to be guarded.