DRF permissions in Django - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the base permission class in Django REST Framework.

Django

from rest_framework.permissions import [1]

Drag options to blanks, or click blank then click option'

ABasePermission

BIsAuthenticated

CAllowAny

DIsAdminUser

Attempts:

3 left

💡 Hint

Common Mistakes

Importing a specific permission like IsAuthenticated instead of the base class.

Misspelling the class name.

The BasePermission class is the base class for all permissions in DRF. Importing it allows you to create custom permissions.

2fill in blank

medium

Complete the code to set the permission class to allow only authenticated users in a DRF view.

Django

from rest_framework.permissions import IsAuthenticated

class MyView(APIView):
    permission_classes = [[1]]

Drag options to blanks, or click blank then click option'

AAllowAny

BIsAuthenticated

CBasePermission

DIsAdminUser

Attempts:

3 left

💡 Hint

Common Mistakes

Using AllowAny which allows all users.

Using IsAdminUser which restricts to admin users only.

The IsAuthenticated permission class restricts access to authenticated users only.

3fill in blank

hard

Fix the error in the custom permission class method name to check permissions.

Django

from rest_framework.permissions import BasePermission

class IsOwner(BasePermission):
    def [1](self, request, view, obj):
        return obj.owner == request.user

Drag options to blanks, or click blank then click option'

Acheck_object_permission

Bhas_permission

Ccheck_permission

Dhas_object_permission

Attempts:

3 left

💡 Hint

Common Mistakes

Using has_permission which checks general permission, not object-level.

Using non-existent method names like check_permission.

The method to check permissions against a specific object is has_object_permission.

4fill in blank

hard

Fill both blanks to create a custom permission that allows access only if the user is staff and the request method is safe.

Django

from rest_framework.permissions import BasePermission, SAFE_METHODS

class StaffReadOnly(BasePermission):
    def has_permission(self, request, view):
        return request.user.is_staff and request.method [1] SAFE_METHODS

Drag options to blanks, or click blank then click option'

Anot in

B==

Cin

D!=

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' which compares equality but not membership.

Using 'not in' which would deny safe methods.

The in operator checks if the request method is one of the safe methods like GET or HEAD.

5fill in blank

hard

Fill all three blanks to define a custom permission that allows access only if the user is authenticated, is the object's owner, and the request method is safe.

Django

from rest_framework.permissions import BasePermission, SAFE_METHODS

class IsOwnerOrReadOnly(BasePermission):
    def has_object_permission(self, request, view, obj):
        if request.method [1] SAFE_METHODS:
            return True
        return obj.owner [2] request.user and request.user.[3]

Drag options to blanks, or click blank then click option'

Ain

B==

Cis_authenticated

D!=

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' instead of 'in' for method membership.

Checking user authentication incorrectly.

This permission allows safe methods for everyone, but for other methods, it checks if the user owns the object and is authenticated.