AttributeError: 'NoneType' object has no attribute 'is_superuser'

[dalmia]

Hey everyone,

Thank you so much for the amazing work done by all the contributors. I am very grateful for your work.

We've been using DRF for managing our APIs and while everything seems to be working fine on production, we are constantly seeing this error in the production logs:

File "/app/users/views.py", line 103, in get_queryset
if self.request.user.is_superuser:
AttributeError: 'NoneType' object has no attribute 'is_superuser'

A bit about the structure of the app:
We have a model for users (User), organizations (Organization) and organization users (OrganizationUser). The User model contains a field called organizations which gets auto-populated based on the entries in the OrganizationUser table (many-to-many relationship).

The line mentioned above in the logs appears in the OrganizationUserViewSet as shown below:

class OrganizationUserViewSet(viewsets.ModelViewSet):
    def get_queryset(self):
        # get all organizations where the current user is a super-admin or org-admin
        if self.request.user.is_superuser:
            return OrganizionUser.objects.all()

        user_organizations = OrganizationUser.objects.filter(
            user=self.request.user, role__name__in=["super-admin", "org-admin"]
        ).all()
       
       .
       .
       .

You can even check out the complete code here.

No other part of the codebase is supposed to be invoking the OrganizationUserViewset apart from the many-to-many relationship mapping in the User model mentioned above.

What do you think could be causing the request.user object to be returned as None?

[lovelydinosaur]

Might be missing or failing to run the middleware to populate request.user, perhaps?
Unauthenticated requests ought to still be populated with an AnonymousUser instance.