DRF permissions in Django - Mini Project: Build & Apply

DRF Permissions Setup

📖 Scenario: You are building a simple API for a blog. You want to control who can see and edit posts using Django REST Framework permissions.

🎯 Goal: Create a Django REST Framework view that uses permissions to allow only authenticated users to create posts, but anyone can read posts.

📋 What You'll Learn

Create a list of posts as initial data

Add a variable to set the permission class

Use the permission class in a DRF API view

Complete the view with the correct permission setup

💡 Why This Matters

🌍 Real World

APIs often need to control who can read or write data. Using DRF permissions helps secure your API endpoints.

💼 Career

Understanding DRF permissions is essential for backend developers working with Django REST Framework to build secure and user-friendly APIs.

1

Create initial posts data

Create a list called posts with these exact dictionaries: {'id': 1, 'title': 'First Post'} and {'id': 2, 'title': 'Second Post'}.

Django

# Your code here

Hint

Use a list with two dictionaries exactly as shown.

2

Set permission classes variable

Create a variable called permission_classes and set it to a list containing IsAuthenticatedOrReadOnly.

Django

posts = [
    {'id': 1, 'title': 'First Post'},
    {'id': 2, 'title': 'Second Post'}
]
# Your code here

Hint

Import IsAuthenticatedOrReadOnly and assign it inside a list to permission_classes.

3

Create API view with permission

Create a class called PostList that inherits from APIView and set its permission_classes attribute to the variable permission_classes.

Django

from rest_framework.permissions import IsAuthenticatedOrReadOnly
from rest_framework.views import APIView

posts = [
    {'id': 1, 'title': 'First Post'},
    {'id': 2, 'title': 'Second Post'}
]

permission_classes = [IsAuthenticatedOrReadOnly]
# Your code here

Hint

Define PostList with permission_classes attribute and a get method returning posts.

4

Add POST method with permission check

Inside the PostList class, add a post method that accepts request, appends request.data to posts, and returns the new post with status 201. Use the existing permission_classes to allow only authenticated users to post.

Django

from rest_framework.permissions import IsAuthenticatedOrReadOnly
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import status

posts = [
    {'id': 1, 'title': 'First Post'},
    {'id': 2, 'title': 'Second Post'}
]

permission_classes = [IsAuthenticatedOrReadOnly]

class PostList(APIView):
    permission_classes = permission_classes

    def get(self, request):
        return Response(posts)

    # Your code here

Hint

Add a post method that appends request.data to posts and returns it with status 201.

Practice

1. What is the main purpose of permissions in Django REST Framework (DRF)?

easy

A. To control who can access or modify API endpoints

B. To style the API responses

C. To speed up database queries

D. To manage user sessions

Solution

1. Step 1: Understand the role of permissions in DRF

   Permissions define rules about who can use or change API data.

2. Step 2: Compare options with permissions purpose

   Only controlling access matches the purpose of permissions.

3. Final Answer:

   To control who can access or modify API endpoints -> Option A

4. Quick Check:

   Permissions = Access control [OK]

Hint: Permissions control access, not styling or speed [OK]

Common Mistakes:

• Confusing permissions with styling or performance
• Thinking permissions manage sessions

2. Which of the following is the correct way to apply the built-in permission IsAuthenticated to a DRF view?

easy

A. permissions = IsAuthenticated()

B. permission_classes = [IsAuthenticated]

C. permission_classes = IsAuthenticated

D. permission_classes = (IsAuthenticated)

Solution

1. Step 1: Recall DRF permission syntax

   Permissions are set as a list or tuple in permission_classes.

2. Step 2: Check each option's syntax

   permission_classes = [IsAuthenticated] uses a list with the class name, which is correct. permissions = IsAuthenticated() uses wrong attribute name and instance. permission_classes = IsAuthenticated misses list brackets. permission_classes = (IsAuthenticated) uses parentheses but without a comma, so it's not a tuple.

3. Final Answer:

   permission_classes = [IsAuthenticated] -> Option B

4. Quick Check:

   Use list for permission_classes [OK]

Hint: Use a list of permission classes for permission_classes [OK]

Common Mistakes:

• Using instance instead of class in permission_classes
• Forgetting to wrap in list or tuple
• Using wrong attribute name

3. Given this DRF view snippet, what will happen if an anonymous user tries to access it?

from rest_framework.permissions import IsAuthenticated
from rest_framework.views import APIView

class MyView(APIView):
    permission_classes = [IsAuthenticated]

    def get(self, request):
        return Response({'message': 'Hello'})

medium

A. The user will receive a 401 Unauthorized response

B. The user will see the message 'Hello'

C. The user will receive a 403 Forbidden response

D. The server will raise a syntax error

Solution

1. Step 1: Understand IsAuthenticated permission behavior

   This permission denies access to anonymous users and returns 401 Unauthorized.

2. Step 2: Analyze the code behavior for anonymous user

   Since the user is not logged in, DRF returns 401, not 403 or success.

3. Final Answer:

   The user will receive a 401 Unauthorized response -> Option A

4. Quick Check:

   IsAuthenticated denies anonymous with 401 [OK]

Hint: IsAuthenticated returns 401 for anonymous users [OK]

Common Mistakes:

• Confusing 401 Unauthorized with 403 Forbidden
• Expecting anonymous users to see data
• Thinking code has syntax errors

4. Identify the error in this custom permission class:

from rest_framework.permissions import BasePermission

class IsOwner(BasePermission):
    def has_object_permission(self, request, view, obj):
        return obj.owner == request.user

# Usage in view
class MyView(APIView):
    permission_classes = [IsOwner()]

    def get(self, request, pk):
        obj = get_object(pk)
        self.check_object_permissions(request, obj)
        return Response({'id': obj.id})

medium

A. get_object method is undefined

B. has_object_permission method is missing a return statement

C. check_object_permissions is called incorrectly

D. Permission class should be passed as class, not instance

Solution

1. Step 1: Check how permission_classes should be set

   DRF expects permission classes, not instances, so use IsOwner without parentheses.

2. Step 2: Review other parts for errors

   has_object_permission returns correctly, check_object_permissions usage is correct, get_object assumed defined elsewhere.

3. Final Answer:

   Permission class should be passed as class, not instance -> Option D

4. Quick Check:

   Use class names, not instances in permission_classes [OK]

Hint: Use class names, not instances, in permission_classes [OK]

Common Mistakes:

• Passing permission instances instead of classes
• Assuming missing return in has_object_permission
• Confusing method calls with errors

5. You want to create a custom permission that allows access only if the user is authenticated and is the owner of the object. Which is the correct way to combine built-in and custom permissions in DRF?

hard

A. Set permission_classes = [IsAuthenticatedOrReadOnly, IsOwner] and override has_permission in IsOwner

B. Set permission_classes = [IsOwner] only and check authentication inside IsOwner

C. Set permission_classes = [IsAuthenticated, IsOwner] and implement has_object_permission in IsOwner

D. Set permission_classes = [IsAuthenticated()] and call IsOwner manually in the view

Solution

1. Step 1: Understand combining permissions in DRF

   DRF checks all permissions in the list; all must allow access.

2. Step 2: Check how to combine authentication and ownership

   Use IsAuthenticated to check login, and IsOwner to check object ownership via has_object_permission.

3. Step 3: Evaluate options

   Set permission_classes = [IsAuthenticated, IsOwner] and implement has_object_permission in IsOwner correctly combines both permissions. Set permission_classes = [IsOwner] only and check authentication inside IsOwner misses separate authentication check. Set permission_classes = [IsAuthenticatedOrReadOnly, IsOwner] and override has_permission in IsOwner mixes permission types incorrectly. Set permission_classes = [IsAuthenticated()] and call IsOwner manually in the view uses instance and manual calls, which is not standard.

4. Final Answer:

   Set permission_classes = [IsAuthenticated, IsOwner] and implement has_object_permission in IsOwner -> Option C

5. Quick Check:

   Combine permissions in list for layered checks [OK]

Hint: List all needed permissions in permission_classes [OK]

Common Mistakes:

• Skipping IsAuthenticated when ownership matters
• Using instances instead of classes
• Trying to call permissions manually