DRF permissions in Django - Step-by-Step Execution

Concept Flow - DRF permissions

Request Received

↓

Check Permission Classes

↓

Call has_permission()

Yes↓

Call has_object_permission() if object

Yes↓

Allow Access

No↓

Deny Access (Raise PermissionDenied)

When a request comes in, DRF checks permission classes by calling has_permission(), then has_object_permission() if needed, to decide if access is allowed or denied.

Execution Sample

Django

from rest_framework.permissions import IsAuthenticated
from rest_framework.views import APIView
from rest_framework.response import Response

class MyView(APIView):
    permission_classes = [IsAuthenticated]

    def get(self, request):
        return Response({'msg': 'Hello'})

This code checks if the user is authenticated before allowing access to the GET method.

Execution Table

Step	Action	Permission Method Called	User Authenticated?	Result	Access Outcome
1	Request received for GET /myview/	N/A	N/A	Start permission check	Pending
2	Check permission_classes	has_permission()	True	Permission granted	Pending
3	No object-level permission needed	N/A	N/A	Skip has_object_permission	Pending
4	Allow access to GET method	N/A	N/A	Access allowed	Access Granted
5	Return response {'msg': 'Hello'}	N/A	N/A	Response sent	Access Granted
6	If user was not authenticated	has_permission()	False	Permission denied	Access Denied

💡 Access is granted only if has_permission() returns True; otherwise, access is denied.

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
user.is_authenticated	Unknown	True	True	True
permission_granted	False	True	True	True
access_outcome	Pending	Pending	Access Granted	Access Granted

Key Moments - 2 Insights

Why does DRF call has_permission() before has_object_permission()?

has_permission() checks general access like authentication before checking specific object permissions in has_object_permission(), as shown in steps 2 and 3 of the execution_table.

What happens if the user is not authenticated?

If user.is_authenticated is False, has_permission() returns False (step 6), and DRF denies access immediately without calling has_object_permission().

Visual Quiz - 3 Questions

Look at the execution_table, what is the result of has_permission() when the user is authenticated?

A Permission granted

B Permission denied

C No permission check

D Error raised

💡 Hint

Check step 2 in the execution_table where has_permission() is called with user authenticated.

At which step does DRF decide to allow access to the GET method?

A Step 1

B Step 4

C Step 3

D Step 6

💡 Hint

Look for the step where 'Allow access to GET method' happens in the execution_table.

If the user is not authenticated, which permission method causes access denial?

A permission_classes attribute

B has_object_permission()

C has_permission()

D get() method

💡 Hint

See step 6 in the execution_table where has_permission() returns False.

Concept Snapshot

DRF Permissions check access by calling has_permission() first.
has_object_permission() runs only if object-level check is needed.
If any permission method returns False, access is denied.
Use permission_classes list to set permissions on views.
Common permission: IsAuthenticated checks user login.
Permissions protect API endpoints from unauthorized access.

Full Transcript

When a request comes to a Django REST Framework view, it checks permissions to decide if the user can access the resource. First, it calls has_permission() on each permission class to check general access like authentication. If the user passes this, and if the request targets a specific object, it calls has_object_permission() to check object-level rights. If any check fails, DRF denies access immediately. For example, the IsAuthenticated permission class returns True only if the user is logged in. This process ensures only authorized users can use the API endpoints.