DRF permissions in Django - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of permissions in Django REST Framework (DRF)?

Permissions control who can access or modify API endpoints. They help protect data by allowing only authorized users to perform certain actions.

beginner

Name the default permission class in DRF and its behavior.

The default permission class is <code>AllowAny</code>. It lets anyone access the API without restrictions.

intermediate

How do you apply permissions globally in a DRF project?

Set the DEFAULT_PERMISSION_CLASSES in the REST_FRAMEWORK settings in settings.py. This applies the permission to all views unless overridden.

intermediate

What is the difference between IsAuthenticated and IsAdminUser permission classes?

IsAuthenticated allows access only to logged-in users. IsAdminUser allows access only to users with admin status (staff users).

advanced

How can you create a custom permission in DRF?

Create a class inheriting from <code>BasePermission</code> and override the <code>has_permission</code> or <code>has_object_permission</code> methods to define your rules.

Which DRF permission class allows unrestricted access to all users?

A IsAuthenticated

B IsAdminUser

C AllowAny

D IsAuthenticatedOrReadOnly

AllowAny lets anyone access the API without restrictions.

Where do you set global permissions for all DRF views?

A In each view's <code>permission_classes</code> attribute

B In <code>REST_FRAMEWORK['DEFAULT_PERMISSION_CLASSES']</code> in <code>settings.py</code>

C In <code>urls.py</code>

D In the database

Global permissions are set in settings.py under REST_FRAMEWORK['DEFAULT_PERMISSION_CLASSES'].

Which permission class restricts access to only logged-in users?

A IsAuthenticated

B AllowAny

C IsAdminUser

D DjangoModelPermissions

IsAuthenticated allows access only to users who are logged in.

What method do you override to check object-level permissions in a custom DRF permission?

A validate_permission

B has_permission

C check_permission

D has_object_permission

Override has_object_permission to check permissions for specific objects.

Which permission class allows read-only access to unauthenticated users but requires login for write actions?

A IsAuthenticatedOrReadOnly

B IsAdminUser

C AllowAny

D IsAuthenticated

IsAuthenticatedOrReadOnly lets anyone read but only logged-in users write.

Explain how DRF permissions help secure an API and give examples of built-in permission classes.

Think about who can see or change data in your API.

Describe the steps to create and use a custom permission class in Django REST Framework.

Custom permissions let you write your own rules.