Permission required decorator in Django - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the @permission_required decorator in Django?

It restricts access to a view so that only users with a specific permission can use it. If the user lacks the permission, they are redirected or shown an error.

beginner

How do you specify which permission a Django view requires using @permission_required?

You pass the permission as a string argument in the format 'app_label.permission_codename' to the decorator.

intermediate

What happens if a user without the required permission tries to access a view decorated with @permission_required?

By default, the user is redirected to the login page. You can change this behavior by setting the raise_exception=True argument to show a 403 Forbidden error instead.

beginner

Write a simple example of using @permission_required to require the permission polls.can_vote on a view.

from django.contrib.auth.decorators import permission_required

@permission_required('polls.can_vote')
def vote(request):
    # view code here
    pass

intermediate

Can @permission_required be used with class-based views in Django?

Not directly. You can use the PermissionRequiredMixin from django.contrib.auth.mixins to enforce permissions on class-based views.

What argument format does @permission_required expect for the permission?

A 'permission_codename'

B 'permission_codename.app_label'

C 'app_label.permission_codename'

D 'app_label'

The permission must be specified as 'app_label.permission_codename', for example 'polls.can_vote'.

What does setting raise_exception=True in @permission_required do?

A Redirects to login page

B Raises a 403 Forbidden error

C Grants permission automatically

D Logs the user out

Setting raise_exception=True causes Django to raise a 403 Forbidden error instead of redirecting.

Which import is needed to use @permission_required?

A from django.contrib.auth.decorators import permission_required

B from django.shortcuts import permission_required

C from django.views.decorators import permission_required

D from django.contrib.auth.mixins import permission_required

The decorator is imported from django.contrib.auth.decorators.

If you want to protect a class-based view with permissions, what should you use?

A No protection needed

B @permission_required decorator

C login_required decorator

D PermissionRequiredMixin

PermissionRequiredMixin is designed for class-based views to enforce permissions.

What happens if an anonymous user accesses a view with @permission_required?

A They are redirected to login page

B They get access anyway

C They see a 404 error

D They get a 500 server error

Anonymous users are redirected to the login page by default.

Explain how the @permission_required decorator works in Django and how you use it in a function-based view.

Think about how you protect a view so only certain users can use it.

Describe the difference between using @permission_required and PermissionRequiredMixin in Django.

Consider the type of view you want to protect.

Practice

1. What is the main purpose of the @permission_required decorator in Django?

easy

A. To restrict access to a view based on user permissions

B. To automatically log users in

C. To change the URL of a view

D. To cache the output of a view

Solution

1. Step 1: Understand the decorator's role

   The @permission_required decorator checks if a user has a specific permission before allowing access to a view.

2. Step 2: Compare options with the decorator's function

   Only To restrict access to a view based on user permissions describes restricting access based on permissions, which matches the decorator's purpose.

3. Final Answer:

   To restrict access to a view based on user permissions -> Option A

4. Quick Check:

   Permission check = restrict access [OK]

Hint: Decorator controls access by permissions, not login or caching [OK]

Common Mistakes:

• Confusing permission check with login functionality
• Thinking it changes URLs
• Assuming it caches view output

2. Which of the following is the correct way to use @permission_required to require the permission app.view_item on a Django view function?

easy

A. @permission_required('app.view_item')\ndef my_view(request):\n pass

B. @permission_required(app.view_item)\ndef my_view(request):\n pass

C. @permission_required('app.view_item', login_url='/login')\ndef my_view():\n pass

D. @permission_required('app.view_item', raise_exception=True)\nclass MyView(View):\n pass

Solution

1. Step 1: Check correct syntax for permission string

   The permission must be a string in quotes, like 'app.view_item'. @permission_required('app.view_item')\ndef my_view(request):\n pass uses this correctly.

2. Step 2: Confirm usage on a function-based view

   @permission_required('app.view_item')\ndef my_view(request):\n pass decorates a function with the correct signature (request parameter). @permission_required(app.view_item)\ndef my_view(request):\n pass misses quotes, C misses request parameter, D decorates a class incorrectly.

3. Final Answer:

   @permission_required('app.view_item')\ndef my_view(request):\n pass -> Option A

4. Quick Check:

   Permission string in quotes + function with request = correct [OK]

Hint: Permission must be a quoted string; function needs request param [OK]

Common Mistakes:

• Omitting quotes around permission string
• Using decorator on class without proper mixin
• Missing request parameter in view function

3. Given this view code, what happens when a user without the app.change_item permission accesses /edit-item/?

@permission_required('app.change_item', login_url='/login/')
def edit_item(request):
    return HttpResponse('Item edited')

medium

A. User gets a 403 Forbidden error

B. User is redirected to '/login/' page

C. User sees 'Item edited' message

D. User is redirected to homepage

Solution

1. Step 1: Understand the decorator parameters

   The decorator requires 'app.change_item' permission and sets login_url='/login/' for unauthorized users.

2. Step 2: Determine behavior for user without permission

   Since raise_exception is not set, the user is redirected to the login URL specified.

3. Final Answer:

   User is redirected to '/login/' page -> Option B

4. Quick Check:

   Missing permission + login_url = redirect to login [OK]

Hint: No raise_exception means redirect to login_url [OK]

Common Mistakes:

• Assuming 403 error without raise_exception=True
• Thinking user sees success message without permission
• Confusing redirect URL

4. Identify the error in this code snippet using @permission_required:

@permission_required('app.delete_item', raise_exception=True)
def delete_item():
    return HttpResponse('Deleted')

medium

A. raise_exception cannot be True

B. Permission string is not quoted

C. Missing request parameter in the view function

D. Decorator must be applied to a class, not a function

Solution

1. Step 1: Check function signature

   The view function must accept at least one parameter, usually request. Here, it is missing.

2. Step 2: Validate decorator usage

   The permission string is quoted correctly, and raise_exception=True is valid. The decorator can be used on functions.

3. Final Answer:

   Missing request parameter in the view function -> Option C

4. Quick Check:

   View needs request param, else error [OK]

Hint: View functions always need request parameter [OK]

Common Mistakes:

• Forgetting the request argument in view functions
• Thinking raise_exception=True is invalid
• Believing decorator only works on classes

5. You want to protect a Django view so that only users with app.add_item permission can access it. If they lack permission, you want to show a 403 error instead of redirecting. Which is the correct way to do this?

hard

A. @permission_required('app.add_item', raise_exception=False)\ndef add_item(request):\n return HttpResponse('Item added')

B. @permission_required('app.add_item', login_url='/login/')\ndef add_item(request):\n return HttpResponse('Item added')

C. @permission_required('app.add_item')\ndef add_item(request):\n return HttpResponse('Item added')

D. @permission_required('app.add_item', raise_exception=True)\ndef add_item(request):\n return HttpResponse('Item added')

Solution

1. Step 1: Understand the effect of raise_exception

   Setting raise_exception=True causes Django to return a 403 Forbidden error if the user lacks permission.

2. Step 2: Check other options for behavior

   Options A, B, and C redirect to login or default behavior (no raise_exception=True); only D raises a 403.

3. Final Answer:

   @permission_required('app.add_item', raise_exception=True)\ndef add_item(request):\n return HttpResponse('Item added') -> Option D

4. Quick Check:

   raise_exception=True = 403 error [OK]

Hint: Use raise_exception=True for 403 error on missing permission [OK]

Common Mistakes:

• Forgetting raise_exception=True to get 403 error
• Assuming login_url triggers 403 error
• Using raise_exception=False expecting error