Hi @sacgup could you provide a minimum working example I can work with? I haven't found a simple workaround and need to investigate further.

Hi @masci

Just override the default oauth2 backend class from OauthLibCore to JSONOauthLibCore in settings.py.

OAUTH2_PROVIDER = {
    # this is the list of available scopes
    'SCOPES': {'read': 'Read scope', 'write': 'Write scope'},
    'OAUTH2_VALIDATOR_CLASS': 'external.validators.EmailOAuth2Validator', # Self over ride : To use email as username to get access tokens
    # 'OAUTH2_BACKEND_CLASS': 'oauth2_provider.oauth2_backends.JSONOAuthLibCore'
}

and use the authentication class from oauth2_provider in django rest framework.
Make a request to any api of rest framework in multipart form-data or x-www-form-urlencoded content type.

You will be able to see the error.

What i have found out till now:
JSONOauthLibCore reads the request body to get the json data and authenticate the request.
Then, django also reads the body later in it's http request class and gives error at that point of time because django allows to read request body only once. ( Don't know Why ? )

The calls to oauth2_provider to get access token will work. Only call to other rest Api's will fail.
IMO, Oauth2_provider shouldn't read request body to authenticate api calls. Only Authorization token should be read from header to authenticate the request.

I stubble upon the same issue today. You can't read the request body twice indeed.

A simple fix would be to force users to use the Authorization header, no ?
Or we could specify this behavior in the documentation ?

It that's a yes, I'm happy to make a pull request for this.

For now my work around is to override the OAUTH2_BACKEND_CLASS setting with a class that overrides the verify_request to not parse the body at this authentication stage.

class OAuthHeaderBasedAuthenticationCore(OAuthLibCore):

    def extract_body(self, request):
        """
        Explanation on why we override this method 

        NB: because the authentication stage doesn't need to read the request body
            indeed the authentication credentials are available in the `Authorization` header
            and recent versions of Django it can't be read twice.
            So without this custom OAuth2 core class multipart-form request are broken
        """
        return {}

OAUTH2_PROVIDER = {
    #...

    # NB: switch the oauth backend to avoid reading the body twice and breaking multipart-forms
    'OAUTH2_BACKEND_CLASS': 'apps.apiv1.oauth2_backends.OAuthHeaderBasedAuthenticationCore',
}

@dulaccc simply use your own backend this way:

from rest_framework.request import Request
from oauth2_provider import oauth2_backends


class OAuthLibCore(oauth2_backends.OAuthLibCore):
    """Backend for Django Rest Framework"""

    def extract_body(self, request):
        """
        DRF object keeps data in request.DATA whether django request
        inside POST
        """
        if isinstance(request, Request):
            try:
                return request.DATA.items()

            # complex json request (list?) is not easily serializable
            except (ValueError, AttributeError):
                return ""

        return super(OAuthLibCore, self).extract_body(request)

Nice @pySilver that's a way better implementation, more general in the case handling.
Shouldn't it the default backend when using DRF ? it is not clear in the documentation and it is a very subtle bug.

@dulaccc also, about built in integration with DRF be aware of:

• Authentication backend is not checking whether user is active like DRF authenticators do, so it's better to subclass it or create pull here

Hi @dulacp,

I am facing the same issue that is "You cannot access body after reading from request's data stream" when I am trying to POST data to a Django REST API.
I have added 'oauth2_provider.contrib.rest_framework.OAuth2Authentication' in the "REST_FRAMEWORK" like so in the settings.py -

REST_FRAMEWORK = { ... 'DEFAULT_AUTHENTICATION_CLASSES': ( ... 'oauth2_provider.contrib.rest_framework.OAuth2Authentication', ... ),

I have downloaded "django-oauth-toolkit" last week using the command:
pip3 install django-oauth-toolkit

Could you please help?