DjangoObjectPermissions

The DjangoObjectPermissions allows per-object permissions on models, which can set permissions for individual rows in a table (model instances). The user must be authenticated to grant authorization and should be assigned with relevant per-object permissions and relevant model permissions. To set relevant per-object permissions, we need to subclass the DjangoObjectPermissions and implement the has_object_permission() method.  The relevant model permissions are as follows:

• The user must have the add permission on the model to make POST requests.
• The user must have the change permission on the model to make PUT and PATCH requests.
• The user must have the delete permission on the model to make DELETE requests.

With DjangoModelPermissions you can create custom model permissions by overriding DjangoObjectPermissions. You can check Customizing Object Level Permission in Django REST Framework.

There are many different scenarios to consider when it comes to access control. Allowing unauthorized access to risky operations or restricted areas results in a massive vulnerability. This highlights the importance of adding permissions in APIs.  

Django REST framework allows us to leverage permissions to define what can be accessed and what actions can be performed in a meaningful or common way. The permission checks always run at the beginning of every view. It uses the authentication information in the ‘request.user’ and ‘request.auth’ properties for each incoming request. If the permission check fails, then the view code will not run. 

Note: Together with authentication, permissions determine whether to grant or deny access for an incoming request. In this section, we will combine Basic Authentication with Django REST framework permission to set access control. You can refer Browsable API in Django REST Framework for Models, Serializers, and Views

Let’s dig deep into the Django REST framework permissions.

• AllowAny
• IsAuthenticated
• IsAdminUser
• IsAuthenticatedOrReadOnly
• DjangoModelPermissions
• DjangoModelPermissionsOrAnonReadOnly
• DjangoObjectPermissions