Permission required decorator in Django - Step-by-Step Execution

Concept Flow - Permission required decorator

Request comes in

↓

Decorator checks user permissions

↓

Run view

↓

Response sent back

The decorator checks if the user has the needed permission before running the view. If yes, the view runs; if no, a 403 error is returned.

Execution Sample

Django

@permission_required('app.view_item')
def my_view(request):
    return HttpResponse('Allowed')

This code checks if the user has 'app.view_item' permission before running my_view.

Execution Table

Step	Action	User Permission Check	Result	View Execution	Response
1	Request received	Check if user has 'app.view_item'	User has permission	View runs	HttpResponse with 'Allowed'
2	Request received	Check if user has 'app.view_item'	User lacks permission	View blocked	HttpResponse 403 Forbidden

💡 Execution stops after permission check fails or view returns response.

Variable Tracker

Variable	Start	After Check	Final
user.has_perm('app.view_item')	Unknown	True or False	True or False

Key Moments - 2 Insights

Why does the view not run if the user lacks permission?

Because the decorator checks permissions first (see execution_table step 2) and returns 403 before calling the view.

What happens if the user has the permission?

The decorator lets the view run normally (see execution_table step 1), so the user gets the expected response.

Visual Quiz - 3 Questions

Look at the execution table, what response is returned if the user lacks permission?

A HttpResponse with 'Allowed'

B HttpResponse 403 Forbidden

C Redirect to login page

D Empty response

💡 Hint

Check execution_table row 2, 'Response' column.

At which step does the view function actually run?

A Step 2

B Before step 1

C Step 1

D After step 2

💡 Hint

See execution_table row 1, 'View Execution' column.

If the decorator is removed, what changes in the execution table?

A Permission check is skipped, view always runs

B 403 Forbidden is always returned

C Request is blocked before view

D Response is delayed

💡 Hint

Without decorator, no permission check step exists.

Concept Snapshot

Permission required decorator syntax:
@permission_required('app.permission_name')
Checks if user has permission before running view.
If yes, view runs and returns response.
If no, returns 403 Forbidden response.
Prevents unauthorized access simply.

Full Transcript

The permission required decorator in Django checks if the user has a specific permission before allowing a view to run. When a request comes in, the decorator first checks the user's permissions. If the user has the required permission, the view function executes and returns its response. If the user lacks the permission, the decorator stops the view from running and returns a 403 Forbidden response instead. This protects views from unauthorized access. The execution table shows two main paths: one where the user has permission and the view runs, and one where the user does not and gets blocked. The variable tracker follows the permission check result. Key moments include understanding why the view does not run without permission and what happens when permission is granted. The visual quiz tests understanding of these steps and outcomes. This decorator is a simple way to secure views in Django.

Practice

1. What is the main purpose of the @permission_required decorator in Django?

easy

A. To restrict access to a view based on user permissions

B. To automatically log users in

C. To change the URL of a view

D. To cache the output of a view

Solution

1. Step 1: Understand the decorator's role

   The @permission_required decorator checks if a user has a specific permission before allowing access to a view.

2. Step 2: Compare options with the decorator's function

   Only To restrict access to a view based on user permissions describes restricting access based on permissions, which matches the decorator's purpose.

3. Final Answer:

   To restrict access to a view based on user permissions -> Option A

4. Quick Check:

   Permission check = restrict access [OK]

Hint: Decorator controls access by permissions, not login or caching [OK]

Common Mistakes:

• Confusing permission check with login functionality
• Thinking it changes URLs
• Assuming it caches view output

2. Which of the following is the correct way to use @permission_required to require the permission app.view_item on a Django view function?

easy

A. @permission_required('app.view_item')\ndef my_view(request):\n pass

B. @permission_required(app.view_item)\ndef my_view(request):\n pass

C. @permission_required('app.view_item', login_url='/login')\ndef my_view():\n pass

D. @permission_required('app.view_item', raise_exception=True)\nclass MyView(View):\n pass

Solution

1. Step 1: Check correct syntax for permission string

   The permission must be a string in quotes, like 'app.view_item'. @permission_required('app.view_item')\ndef my_view(request):\n pass uses this correctly.

2. Step 2: Confirm usage on a function-based view

   @permission_required('app.view_item')\ndef my_view(request):\n pass decorates a function with the correct signature (request parameter). @permission_required(app.view_item)\ndef my_view(request):\n pass misses quotes, C misses request parameter, D decorates a class incorrectly.

3. Final Answer:

   @permission_required('app.view_item')\ndef my_view(request):\n pass -> Option A

4. Quick Check:

   Permission string in quotes + function with request = correct [OK]

Hint: Permission must be a quoted string; function needs request param [OK]

Common Mistakes:

• Omitting quotes around permission string
• Using decorator on class without proper mixin
• Missing request parameter in view function

3. Given this view code, what happens when a user without the app.change_item permission accesses /edit-item/?

@permission_required('app.change_item', login_url='/login/')
def edit_item(request):
    return HttpResponse('Item edited')

medium

A. User gets a 403 Forbidden error

B. User is redirected to '/login/' page

C. User sees 'Item edited' message

D. User is redirected to homepage

Solution

1. Step 1: Understand the decorator parameters

   The decorator requires 'app.change_item' permission and sets login_url='/login/' for unauthorized users.

2. Step 2: Determine behavior for user without permission

   Since raise_exception is not set, the user is redirected to the login URL specified.

3. Final Answer:

   User is redirected to '/login/' page -> Option B

4. Quick Check:

   Missing permission + login_url = redirect to login [OK]

Hint: No raise_exception means redirect to login_url [OK]

Common Mistakes:

• Assuming 403 error without raise_exception=True
• Thinking user sees success message without permission
• Confusing redirect URL

4. Identify the error in this code snippet using @permission_required:

@permission_required('app.delete_item', raise_exception=True)
def delete_item():
    return HttpResponse('Deleted')

medium

A. raise_exception cannot be True

B. Permission string is not quoted

C. Missing request parameter in the view function

D. Decorator must be applied to a class, not a function

Solution

1. Step 1: Check function signature

   The view function must accept at least one parameter, usually request. Here, it is missing.

2. Step 2: Validate decorator usage

   The permission string is quoted correctly, and raise_exception=True is valid. The decorator can be used on functions.

3. Final Answer:

   Missing request parameter in the view function -> Option C

4. Quick Check:

   View needs request param, else error [OK]

Hint: View functions always need request parameter [OK]

Common Mistakes:

• Forgetting the request argument in view functions
• Thinking raise_exception=True is invalid
• Believing decorator only works on classes

5. You want to protect a Django view so that only users with app.add_item permission can access it. If they lack permission, you want to show a 403 error instead of redirecting. Which is the correct way to do this?

hard

A. @permission_required('app.add_item', raise_exception=False)\ndef add_item(request):\n return HttpResponse('Item added')

B. @permission_required('app.add_item', login_url='/login/')\ndef add_item(request):\n return HttpResponse('Item added')

C. @permission_required('app.add_item')\ndef add_item(request):\n return HttpResponse('Item added')

D. @permission_required('app.add_item', raise_exception=True)\ndef add_item(request):\n return HttpResponse('Item added')

Solution

1. Step 1: Understand the effect of raise_exception

   Setting raise_exception=True causes Django to return a 403 Forbidden error if the user lacks permission.

2. Step 2: Check other options for behavior

   Options A, B, and C redirect to login or default behavior (no raise_exception=True); only D raises a 403.

3. Final Answer:

   @permission_required('app.add_item', raise_exception=True)\ndef add_item(request):\n return HttpResponse('Item added') -> Option D

4. Quick Check:

   raise_exception=True = 403 error [OK]

Hint: Use raise_exception=True for 403 error on missing permission [OK]

Common Mistakes:

• Forgetting raise_exception=True to get 403 error
• Assuming login_url triggers 403 error
• Using raise_exception=False expecting error