Custom permissions in Django - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a custom permission class in Django REST Framework.

Django

from rest_framework.permissions import [1]

class IsOwnerPermission([1]):
    def has_object_permission(self, request, view, obj):
        return obj.owner == request.user

Drag options to blanks, or click blank then click option'

ABasePermission

BAllowAny

CIsAuthenticated

DDjangoModelPermissions

Attempts:

3 left

💡 Hint

Common Mistakes

Using IsAuthenticated or AllowAny as base class for custom permissions.

Not inheriting from any permission class.

The custom permission class should inherit from BasePermission to define custom logic.

2fill in blank

medium

Complete the code to check if the user is the owner of the object in the permission method.

Django

def has_object_permission(self, request, view, obj):
    return obj.[1] == request.user

Drag options to blanks, or click blank then click option'

Aauthor

Buser

Cowner

Dcreator

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user' instead of 'owner' which may not exist on the object.

Using unrelated attribute names like 'creator' or 'author' without confirming model fields.

The permission checks if the owner attribute of the object matches the current user.

3fill in blank

hard

Fix the error in the permission class by completing the missing import statement.

Django

from rest_framework.permissions import [1], SAFE_METHODS

class IsAdminOrReadOnly([1]):
    def has_permission(self, request, view):
        if request.method in SAFE_METHODS:
            return True
        return request.user and request.user.is_staff

Drag options to blanks, or click blank then click option'

ADjangoModelPermissions

BIsAuthenticated

CAllowAny

DBasePermission

Attempts:

3 left

💡 Hint

Common Mistakes

Forgetting to import BasePermission causes errors.

Using other permission classes that don't support custom logic.

The class should inherit from BasePermission and import it to define custom permission logic.

4fill in blank

hard

Fill both blanks to correctly apply the custom permission class to a Django REST Framework view.

Django

from rest_framework.views import APIView
from .permissions import [1]

class MyView(APIView):
    permission_classes = [[2]]

Drag options to blanks, or click blank then click option'

AIsOwnerPermission

BIsAdminOrReadOnly

CIsAuthenticated

DAllowAny

Attempts:

3 left

💡 Hint

Common Mistakes

Importing one permission but using another in the list.

Not using a list for permission_classes.

The custom permission IsOwnerPermission is imported and applied in the permission_classes list.

5fill in blank

hard

Fill all three blanks to create a custom permission that allows safe methods for everyone but restricts other methods to the object's owner.

Django

from rest_framework.permissions import BasePermission, SAFE_METHODS

class [1](BasePermission):
    def has_object_permission(self, request, view, obj):
        if request.method in [2]:
            return True
        return obj.[3] == request.user

Drag options to blanks, or click blank then click option'

AIsOwnerOrReadOnly

BSAFE_METHODS

Cowner

DIsAdminOrReadOnly

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong class names that don't match the logic.

Forgetting to check safe methods before owner.

Using incorrect attribute names for ownership.

The class IsOwnerOrReadOnly allows safe methods for all and restricts other methods to the object's owner.