Permission required decorator in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user without permission accesses a view with @permission_required?

Consider a Django view decorated with @permission_required('app.view_item'). What is the typical behavior if a logged-in user lacks this permission?

Django

from django.contrib.auth.decorators import permission_required
from django.http import HttpResponse

@permission_required('app.view_item')
def my_view(request):
    return HttpResponse('Access granted')

A The user is redirected to the login page only if not authenticated; otherwise, a 403 error is shown.

B The user can access the view without any restriction.

C The user sees a 403 Forbidden error page.

D The user is redirected to the login page regardless of authentication status.

💡 Hint

Think about how Django handles permissions differently for authenticated and anonymous users.

The @permission_required decorator first checks if the user is authenticated. If not, it redirects to the login page. If authenticated but lacking permission, it returns a 403 Forbidden response.

📝 Syntax

intermediate

Identify the correct syntax to require multiple permissions with @permission_required

Which of the following correctly requires both 'app.view_item' and 'app.change_item' permissions on a Django view?

A

@permission_required('app.view_item')
def my_view(request): pass
@permission_required('app.change_item')

B

@permission_required('app.view_item', 'app.change_item')
def my_view(request): pass

C

@permission_required(['app.view_item', 'app.change_item'])
def my_view(request): pass

D

@permission_required('app.view_item')
@permission_required('app.change_item')
def my_view(request): pass

💡 Hint

Think about stacking decorators to require multiple permissions.

The @permission_required decorator accepts a single permission string. To require multiple permissions, stack multiple decorators.

🔧 Debug

advanced

Why does this @permission_required decorator not work as expected?

This view should require 'app.delete_item' permission, but users without permission can access it. What is the problem?

Django

from django.contrib.auth.decorators import permission_required
from django.http import HttpResponse

@permission_required
def my_view(request):
    return HttpResponse('Deleted')

A The decorator is missing parentheses after @permission_required.

B The permission string is incorrect; it should be 'app.delete_items' plural.

C The view is missing the login_required decorator, so permission is not checked.

D The view is a function-based view but the decorator only works on class-based views.

💡 Hint

Check how decorators are applied in Python syntax.

The decorator must be called with parentheses and the permission string as an argument. Missing parentheses means the decorator is not applied.

❓ state_output

advanced

What is the HTTP status code returned when permission is denied by @permission_required?

When a logged-in user lacks the required permission for a view decorated with @permission_required, what HTTP status code does Django return?

A 200 OK

B 302 Found (redirect to login)

C 403 Forbidden

D 404 Not Found

💡 Hint

Think about the meaning of HTTP status codes for permission issues.

Django returns a 403 Forbidden status code when an authenticated user lacks the required permission.

🧠 Conceptual

expert

How to customize the redirect URL for unauthorized users with @permission_required?

By default, @permission_required redirects unauthorized users to the login page. How can you change this redirect URL to a custom page?

A Override the <code>LOGIN_REDIRECT_URL</code> setting in Django settings.py.

B Pass the <code>login_url</code> parameter to the decorator with the custom URL.

C Use a middleware to intercept permission errors and redirect manually.

D Modify the view to catch PermissionDenied exceptions and redirect.

💡 Hint

Check the parameters accepted by the decorator.

The @permission_required decorator accepts a login_url argument to specify a custom redirect URL for unauthorized users.