Custom permissions in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this custom permission check?

Consider this Django REST Framework custom permission class. What will be the result of has_permission when the user is authenticated but not staff?

Django

from rest_framework.permissions import BasePermission

class IsStaffUser(BasePermission):
    def has_permission(self, request, view):
        return request.user and request.user.is_staff

# Assume request.user.is_authenticated == True and request.user.is_staff == False
class DummyUser:
    is_authenticated = True
    is_staff = False

class DummyRequest:
    user = DummyUser()

permission = IsStaffUser()
result = permission.has_permission(DummyRequest(), None)

A None

B True

C Raises AttributeError

D False

💡 Hint

Think about what the has_permission method returns based on the is_staff attribute.

The has_permission method returns request.user.is_staff. Since the user is authenticated but not staff, is_staff is False. So the method returns False.

📝 Syntax

intermediate

Which option correctly defines a custom permission class allowing only GET requests?

You want to create a custom permission class in Django REST Framework that allows access only if the HTTP method is GET. Which code snippet is syntactically correct and works as intended?

A

class AllowGetOnly(BasePermission):
    def has_permission(self, request, view):
        return request.method == 'GET'

B

class AllowGetOnly(BasePermission):
    def has_permission(self, request, view):
        if request.method = 'GET':
            return True
        return False

C

class AllowGetOnly(BasePermission):
    def has_permission(self, request, view):
        if request.method == 'GET':
            return True
        else:
            return False

D

class AllowGetOnly(BasePermission):
    def has_permission(self, request, view):
        return request.method is 'GET'

💡 Hint

Check for correct comparison operators and syntax in Python.

Option A uses the correct equality operator == and returns a boolean directly. Option A uses assignment = instead of comparison, causing a syntax error. Option A uses is which is not correct for string comparison. Option A misses a colon after the if statement, causing a syntax error.

🔧 Debug

advanced

Why does this custom permission always deny access?

This custom permission class is intended to allow access only to users with username 'admin'. Why does it always deny access?

Django

from rest_framework.permissions import BasePermission

class IsAdminUser(BasePermission):
    def has_permission(self, request, view):
        if request.user.username == 'admin':
            return True
        else:
            return False

# But in testing, even user 'admin' is denied.

A The method should be named has_object_permission instead

B request.user is AnonymousUser without username attribute

C The permission class is missing the 'SAFE_METHODS' check

D The user model does not have a username field

💡 Hint

Think about what request.user might be if the user is not authenticated.

If the user is not authenticated, request.user is an AnonymousUser which does not have a username attribute. Accessing request.user.username raises an AttributeError, so the permission denies access.

❓ state_output

advanced

What is the value of allowed after running this permission check?

Given this custom permission and a request with method POST and user.is_authenticated True, what is the value of allowed?

Django

from rest_framework.permissions import BasePermission

class IsAuthenticatedAndPost(BasePermission):
    def has_permission(self, request, view):
        return request.user.is_authenticated and request.method == 'POST'

class DummyUser:
    is_authenticated = True

class DummyRequest:
    user = DummyUser()
    method = 'POST'

permission = IsAuthenticatedAndPost()
allowed = permission.has_permission(DummyRequest(), None)

A False

B Raises AttributeError

C True

D None

💡 Hint

Check both conditions in the return statement carefully.

The user is authenticated (True) and the method is 'POST', so both conditions are True. The and operator returns True.

🧠 Conceptual

expert

Which option best describes the purpose of custom permissions in Django REST Framework?

Select the option that most accurately explains why and when you would create custom permission classes in Django REST Framework.

A To define specific rules controlling access to views beyond built-in permissions, such as user roles or request methods

B To replace authentication mechanisms like token or session authentication

C To handle database migrations and schema changes

D To automatically generate API documentation for endpoints

💡 Hint

Think about what permissions control in a web API.

Custom permissions allow developers to enforce specific access rules tailored to their application's needs, such as checking user roles or request types. They do not replace authentication, generate docs, or manage database migrations.