diff --git a/website_require_login/models/ir_http.py b/website_require_login/models/ir_http.py index bcfea63b96..5b2d92786b 100644 --- a/website_require_login/models/ir_http.py +++ b/website_require_login/models/ir_http.py @@ -44,5 +44,7 @@ def _check_require_auth(cls): path = request.httprequest.path for auth_path in auth_paths: if auth_path == path or Path(auth_path) in Path(path).parents: + if request.httprequest.content_type == "application/json": + return False redirect_path = "/web/login?redirect=%s" % path return request.redirect(redirect_path, code=302) diff --git a/website_require_login/tests/test_ir_http.py b/website_require_login/tests/test_ir_http.py index ed172189b4..cf79ae5e98 100644 --- a/website_require_login/tests/test_ir_http.py +++ b/website_require_login/tests/test_ir_http.py @@ -1,3 +1,5 @@ +import json + from odoo.tests import HttpCase @@ -35,3 +37,18 @@ def test_dispatch_authorized(self): 200, "Expected the response status code to be 200 which means no redirection", ) + + def test_dispatch_json_no_redirect(self): + """With Content-Type application/json there should be no redirection.""" + self.authenticate(None, None) + response = self.url_open( + self.path, + data=json.dumps({}), + headers={"Content-Type": "application/json"}, + allow_redirects=False, + ) + self.assertNotEqual( + response.status_code, + 302, + "JSON request should not redirect even if user is not logged in", + )