[Django]-How do I get an Django ViewSet to return a 403 error on anonymous post

You are trying to send a response from perform_create, but this can’t be done. You see, DRF (Django REST Framework) doesn’t call the perform_create method in a straight-forward manner. What happens is that DRF first calls CreateModelMixin‘s create method. Which then calls the perform_create method and then returns the response.

In, short, the response is returned by the create method, not perform_create method. And the create method, by default, returns the 201 status code (or sometimes 400).

So, you will need to override the create method instead. First, take a look at the source code for this method. Now, override:

from rest_framework.exceptions import PermissionDenied

def create(self, request, *args, **kwargs):
    serializer = self.get_serializer(data=request.data)
    serializer.is_valid(raise_exception=True)

    if request.user.is_authenticated:
        self.perform_create(serializer)
    else:
        raise PermissionDenied('Cannot post anonymously')

    headers = self.get_success_headers(serializer.data)
    return Response(serializer.data, status=status.HTTP_201_CREATED, headers=headers)