Allow only JSON rendering for views

src/django_otp_webauthn/views.py

@@ -14,6 +14,7 @@
 from django.views.decorators.cache import never_cache
 from django_otp import login as otp_login
 from rest_framework.permissions import AllowAny, IsAuthenticated
+from rest_framework.renderers import JSONRenderer
 from rest_framework.response import Response
 from rest_framework.views import APIView
 
@@ -89,6 +90,8 @@ class BeginCredentialRegistrationView(RegistrationCeremonyMixin, APIView):
     This view will return a JSON response with the options for the client to use to register a credential.
     """
 
+    renderer_classes = [JSONRenderer]
+
     def post(self, *args, **kwargs):
         user = self.get_user()
         helper = self.get_helper()
@@ -106,6 +109,8 @@ class CompleteCredentialRegistrationView(RegistrationCeremonyMixin, APIView):
     This view accepts client data about the registered credential, validates it, and saves the credential to the database.
     """
 
+    renderer_classes = [JSONRenderer]
+
     def get_state(self):
         """Retrieve the registration state."""
 
@@ -139,6 +144,8 @@ class BeginCredentialAuthenticationView(AuthenticationCeremonyMixin, APIView):
     This view will return a JSON response with the options for the client to use to authenticate with a credential.
     """
 
+    renderer_classes = [JSONRenderer]
+
     def post(self, *args, **kwargs):
         user = self.get_user()
         helper = self.get_helper()
@@ -162,6 +169,8 @@ class CompleteCredentialAuthenticationView(AuthenticationCeremonyMixin, APIView)
     and logs the user in.
     """
 
+    renderer_classes = [JSONRenderer]
+
     def get_state(self):
         """Retrieve the authentication state."""
         # It is VITAL that we pop the state from the session before we do anything else.

tests/unit/test_views.py

@@ -1,5 +1,6 @@
 import pytest
 from django.contrib.auth.models import AnonymousUser
+from rest_framework.renderers import JSONRenderer
 
 from django_otp_webauthn import exceptions
 from django_otp_webauthn.helpers import WebAuthnHelper
@@ -36,6 +37,20 @@ def test_views__no_caching_headers_present(rf, view_class, user_in_memory):
     assert "Expires" in response.headers
 
 
+@pytest.mark.parametrize(
+    "view_class",
+    [
+        BeginCredentialRegistrationView,
+        CompleteCredentialRegistrationView,
+        BeginCredentialAuthenticationView,
+        CompleteCredentialAuthenticationView,
+    ],
+)
+def test_views__no_html_render(view_class):
+    view = view_class()
+    assert view.renderer_classes == [JSONRenderer]
+
+
 def test_pywebauthn_logger(settings):
     settings.OTP_WEBAUTHN_EXCEPTION_LOGGER_NAME = "test_logger"
     _get_pywebauthn_logger.cache_clear()