Why authorization matters in Django - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the Django authorization decorator.

Django

from django.contrib.auth.decorators import [1]

Drag options to blanks, or click blank then click option'

Alogin_required

Bauthenticate

Cpermission_required

Duser_passes_test

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'authenticate' which is a function, not a decorator.

Confusing 'permission_required' with 'login_required'.

The login_required decorator ensures only logged-in users can access a view.

2fill in blank

medium

Complete the code to protect a view so only logged-in users can access it.

Django

@[1]
def dashboard(request):
    return render(request, 'dashboard.html')

Drag options to blanks, or click blank then click option'

Apermission_required

Bcsrf_exempt

Cuser_passes_test

Dlogin_required

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'csrf_exempt' which is unrelated to authorization.

Using 'permission_required' without specifying permissions.

The login_required decorator is used to restrict access to authenticated users.

3fill in blank

hard

Fix the error in the code to check if a user has permission to add a post.

Django

if request.user.has_perm('[1]'):
    # allow adding post
    pass

Drag options to blanks, or click blank then click option'

Ablog.create_post

Bblog.add_post

Cpost.add_blog

Dpost.create_blog

Attempts:

3 left

💡 Hint

Common Mistakes

Swapping app label and model name.

Using 'create' instead of 'add' in permission codename.

The permission string format is '.'. For adding a post in 'blog' app, it's 'blog.add_post'.

4fill in blank

hard

Fill both blanks to restrict a view to users with 'change_article' permission and redirect unauthorized users.

Django

@permission_required('[1]', login_url='[2]')
def edit_article(request):
    return render(request, 'edit.html')

Drag options to blanks, or click blank then click option'

Ablog.change_article

B/login/

C/home/

Dblog.edit_article

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'edit_article' instead of 'change_article' permission.

Redirecting to '/home/' instead of login page.

The permission_required decorator takes the permission string and a login URL to redirect unauthorized users.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension that maps usernames to their email if the user is active.

Django

user_emails = {user.[1]: user.[2] for user in users if user.[3]

Drag options to blanks, or click blank then click option'

Ausername

Bemail

Cis_active

Dis_staff

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'is_staff' instead of 'is_active' to filter users.

Swapping 'username' and 'email' in keys and values.

This comprehension creates a dictionary of usernames to emails only for active users.