Files under /media require session to be authenticated

References:

- https://docs.djangoproject.com/en/3.2/howto/deployment/wsgi/apache-auth/
- https://stackoverflow.com/questions/46421589/nginx-location-and-django-auth
- https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-subrequest-authentication/
- https://pawamoy.github.io/posts/django-auth-server-for-shiny/

InvenTree/InvenTree/urls.py

@@ -37,6 +37,7 @@ from django.conf.urls.static import static
 from django.views.generic.base import RedirectView
 from rest_framework.documentation import include_docs_urls
 
+from .views import auth_request
 from .views import IndexView, SearchView, DatabaseStatsView
 from .views import SettingsView, EditUserView, SetPasswordView
 from .views import CurrencySettingsView, CurrencyRefreshView
@@ -155,6 +156,8 @@ urlpatterns = [
     url(r'^search/', SearchView.as_view(), name='search'),
     url(r'^stats/', DatabaseStatsView.as_view(), name='stats'),
 
+    url(r'^auth/?', auth_request),
+
     url(r'^api/', include(apipatterns)),
     url(r'^api-doc/', include_docs_urls(title='InvenTree API')),
 

InvenTree/InvenTree/views.py

@@ -10,7 +10,7 @@ from __future__ import unicode_literals
 
 from django.utils.translation import gettext_lazy as _
 from django.template.loader import render_to_string
-from django.http import JsonResponse, HttpResponseRedirect
+from django.http import HttpResponse, JsonResponse, HttpResponseRedirect
 from django.urls import reverse_lazy
 from django.conf import settings
 
@@ -36,6 +36,19 @@ from .helpers import str2bool
 from rest_framework import views
 
 
+def auth_request(request):
+    """
+    Simple 'auth' endpoint used to determine if the user is authenticated.
+    Useful for (for example) redirecting authentication requests through
+    django's permission framework.
+    """
+
+    if request.user.is_authenticated:
+        return HttpResponse(status=200)
+    else:
+        return HttpResponse(status=403)
+
+
 class TreeSerializer(views.APIView):
     """ JSON View for serializing a Tree object.