Django — Permissions

Built-in Permissions

Permission	Description
AllowAny	Anyone can access
IsAuthenticated	Must be logged in
IsAdminUser	Must be admin
IsAuthenticatedOrReadOnly	Read for anyone, write for authenticated

View-Level Permissions

from rest_framework.permissions import IsAuthenticated

class PostViewSet(viewsets.ModelViewSet):
    queryset = Post.objects.all()
    serializer_class = PostSerializer
    permission_classes = [IsAuthenticated]

Custom Permission

from rest_framework.permissions import BasePermission

class IsOwnerOrReadOnly(BasePermission):
    def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True
        return obj.author == request.user

class PostViewSet(viewsets.ModelViewSet):
    permission_classes = [IsOwnerOrReadOnly]

Object-Level Permissions

def has_object_permission(self, request, view, obj):
    # Read permissions for any request
    if request.method in permissions.SAFE_METHODS:
        return True
    # Write permissions only to owner
    return obj.author == request.user

Global Permissions

# settings.py
REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.IsAuthenticated',
    ]
}

Mini Practice

1. Add authentication to API
2. Create custom permission class
3. Implement object-level permissions
4. Set global permissions

Up Next

Continue with Routers — URL routing for ViewSets.