Permission required decorator in Django

Introduction

The permission required decorator helps you control who can access certain parts of your Django app. It makes sure only users with the right permissions can see or use specific views.

When you want to restrict access to a page only to users with a specific permission.

When you want to protect sensitive data or actions in your web app.

When you want to avoid writing manual permission checks inside your view functions.

When you want to keep your code clean and easy to read by using decorators.

When you want to redirect unauthorized users to a login or error page automatically.

Syntax

Django

@permission_required('app_label.permission_codename', login_url=None, raise_exception=False)
def your_view(request):
    # view code here

The decorator takes the permission as a string in the format 'app_label.permission_codename'.

You can set login_url to redirect unauthorized users to a custom page.

Examples

This view only allows users with the 'add_choice' permission in the 'polls' app.

Django

@permission_required('polls.add_choice')
def add_choice(request):
    # code to add a choice

Redirects unauthorized users to '/login/' if they lack the 'change_user' permission.

Django

@permission_required('auth.change_user', login_url='/login/')
def edit_user(request):
    # code to edit user

Raises a 403 error instead of redirecting if the user lacks permission.

Django

@permission_required('blog.delete_post', raise_exception=True)
def delete_post(request):
    # code to delete a post

Sample Program

This simple Django view uses the permission required decorator to allow only users with the 'view_poll' permission in the 'polls' app to access it. If the user does not have permission, they are redirected to '/login/'.

Django

from django.contrib.auth.decorators import permission_required
from django.http import HttpResponse

@permission_required('polls.view_poll', login_url='/login/')
def view_poll(request):
    return HttpResponse('You can see this poll because you have permission!')

Important Notes

Make sure the permission codename matches exactly what is defined in your app's models.

If you set raise_exception=True, unauthorized users get a 403 Forbidden error instead of redirect.

Use this decorator only on views that require user authentication and permission checks.

Summary

The permission required decorator controls access to views based on user permissions.

It helps keep your code clean and secure by handling permission checks automatically.

You can customize behavior for unauthorized users with login_url or raise_exception.

Practice

1. What is the main purpose of the @permission_required decorator in Django?

easy

A. To restrict access to a view based on user permissions

B. To automatically log users in

C. To change the URL of a view

D. To cache the output of a view

Solution

1. Step 1: Understand the decorator's role

   The @permission_required decorator checks if a user has a specific permission before allowing access to a view.

2. Step 2: Compare options with the decorator's function

   Only To restrict access to a view based on user permissions describes restricting access based on permissions, which matches the decorator's purpose.

3. Final Answer:

   To restrict access to a view based on user permissions -> Option A

4. Quick Check:

   Permission check = restrict access [OK]

Hint: Decorator controls access by permissions, not login or caching [OK]

Common Mistakes:

• Confusing permission check with login functionality
• Thinking it changes URLs
• Assuming it caches view output

2. Which of the following is the correct way to use @permission_required to require the permission app.view_item on a Django view function?

easy

A. @permission_required('app.view_item')\ndef my_view(request):\n pass

B. @permission_required(app.view_item)\ndef my_view(request):\n pass

C. @permission_required('app.view_item', login_url='/login')\ndef my_view():\n pass

D. @permission_required('app.view_item', raise_exception=True)\nclass MyView(View):\n pass

Solution

1. Step 1: Check correct syntax for permission string

   The permission must be a string in quotes, like 'app.view_item'. @permission_required('app.view_item')\ndef my_view(request):\n pass uses this correctly.

2. Step 2: Confirm usage on a function-based view

   @permission_required('app.view_item')\ndef my_view(request):\n pass decorates a function with the correct signature (request parameter). @permission_required(app.view_item)\ndef my_view(request):\n pass misses quotes, C misses request parameter, D decorates a class incorrectly.

3. Final Answer:

   @permission_required('app.view_item')\ndef my_view(request):\n pass -> Option A

4. Quick Check:

   Permission string in quotes + function with request = correct [OK]

Hint: Permission must be a quoted string; function needs request param [OK]

Common Mistakes:

• Omitting quotes around permission string
• Using decorator on class without proper mixin
• Missing request parameter in view function

3. Given this view code, what happens when a user without the app.change_item permission accesses /edit-item/?

@permission_required('app.change_item', login_url='/login/')
def edit_item(request):
    return HttpResponse('Item edited')

medium

A. User gets a 403 Forbidden error

B. User is redirected to '/login/' page

C. User sees 'Item edited' message

D. User is redirected to homepage

Solution

1. Step 1: Understand the decorator parameters

   The decorator requires 'app.change_item' permission and sets login_url='/login/' for unauthorized users.

2. Step 2: Determine behavior for user without permission

   Since raise_exception is not set, the user is redirected to the login URL specified.

3. Final Answer:

   User is redirected to '/login/' page -> Option B

4. Quick Check:

   Missing permission + login_url = redirect to login [OK]

Hint: No raise_exception means redirect to login_url [OK]

Common Mistakes:

• Assuming 403 error without raise_exception=True
• Thinking user sees success message without permission
• Confusing redirect URL

4. Identify the error in this code snippet using @permission_required:

@permission_required('app.delete_item', raise_exception=True)
def delete_item():
    return HttpResponse('Deleted')

medium

A. raise_exception cannot be True

B. Permission string is not quoted

C. Missing request parameter in the view function

D. Decorator must be applied to a class, not a function

Solution

1. Step 1: Check function signature

   The view function must accept at least one parameter, usually request. Here, it is missing.

2. Step 2: Validate decorator usage

   The permission string is quoted correctly, and raise_exception=True is valid. The decorator can be used on functions.

3. Final Answer:

   Missing request parameter in the view function -> Option C

4. Quick Check:

   View needs request param, else error [OK]

Hint: View functions always need request parameter [OK]

Common Mistakes:

• Forgetting the request argument in view functions
• Thinking raise_exception=True is invalid
• Believing decorator only works on classes

5. You want to protect a Django view so that only users with app.add_item permission can access it. If they lack permission, you want to show a 403 error instead of redirecting. Which is the correct way to do this?

hard

A. @permission_required('app.add_item', raise_exception=False)\ndef add_item(request):\n return HttpResponse('Item added')

B. @permission_required('app.add_item', login_url='/login/')\ndef add_item(request):\n return HttpResponse('Item added')

C. @permission_required('app.add_item')\ndef add_item(request):\n return HttpResponse('Item added')

D. @permission_required('app.add_item', raise_exception=True)\ndef add_item(request):\n return HttpResponse('Item added')

Solution

1. Step 1: Understand the effect of raise_exception

   Setting raise_exception=True causes Django to return a 403 Forbidden error if the user lacks permission.

2. Step 2: Check other options for behavior

   Options A, B, and C redirect to login or default behavior (no raise_exception=True); only D raises a 403.

3. Final Answer:

   @permission_required('app.add_item', raise_exception=True)\ndef add_item(request):\n return HttpResponse('Item added') -> Option D

4. Quick Check:

   raise_exception=True = 403 error [OK]

Hint: Use raise_exception=True for 403 error on missing permission [OK]

Common Mistakes:

• Forgetting raise_exception=True to get 403 error
• Assuming login_url triggers 403 error
• Using raise_exception=False expecting error