Refactor SessionAuthentication slightly

rest_framework/authentication.py

@@ -26,6 +26,12 @@ def get_authorization_header(request):
     return auth
 
 
+class CSRFCheck(CsrfViewMiddleware):
+    def _reject(self, request, reason):
+        # Return the failure reason instead of an HttpResponse
+        return reason
+
+
 class BaseAuthentication(object):
     """
     All authentication classes should extend BaseAuthentication.
@@ -110,20 +116,20 @@ class SessionAuthentication(BaseAuthentication):
         if not user or not user.is_active:
             return None
 
-        # Enforce CSRF validation for session based authentication.
-        class CSRFCheck(CsrfViewMiddleware):
-            def _reject(self, request, reason):
-                # Return the failure reason instead of an HttpResponse
-                return reason
+        self.enforce_csrf(http_request)
+
+        # CSRF passed with authenticated user
+        return (user, None)
 
-        reason = CSRFCheck().process_view(http_request, None, (), {})
+    def enforce_csrf(self, request):
+        """
+        Enforce CSRF validation for session based authentication.
+        """
+        reason = CSRFCheck().process_view(request, None, (), {})
         if reason:
             # CSRF failed, bail with explicit error message
             raise exceptions.AuthenticationFailed('CSRF Failed: %s' % reason)
 
-        # CSRF passed with authenticated user
-        return (user, None)
-
 
 class TokenAuthentication(BaseAuthentication):
     """