Categories
28°C, New York
Home Django DjangoModelPermissionsOrAnonReadOnly

DjangoModelPermissionsOrAnonReadOnly

DjangoModelPermissions

DjangoObjectPermissions

DjangoModelPermissionsOrAnonReadOnly permission class is the same as that of the DjangoModelPermissions class except it allows unauthenticated users to have read-only access to the API. 

Let’s import the DjangoModelPermissionsOrAnonReadOnly class.

from rest_framework.permissions import DjangoModelPermissionsOrAnonReadOnly

Now you can add the permission class to  RobotDetail and RobotList class. The code is as follows:

Python3




class RobotList(generics.ListCreateAPIView):
    permission_classes = [DjangoModelPermissionsOrAnonReadOnly]
    queryset = Robot.objects.all()
    serializer_class = RobotSerializer
    name = 'robot-list'
  
class RobotDetail(generics.RetrieveUpdateDestroyAPIView):
    permission_classes = [DjangoModelPermissionsOrAnonReadOnly]
    queryset = Robot.objects.all()
    serializer_class = RobotSerializer
    name = 'robot-detail'
 






                        









													
													
												

												
												

													
													
Let’s try to retrieve robots without providing any credentials. The HTTPie command is as follows:

													
													
												

												
												

													
													


http :8000/robot/



													
													
												

												
												

													
													
Output

													
													
												

												
												

													
													

													
													
												

												
											

											
											

												
Adding Permission in API – Django REST Framework

												
												

													
													
There are many different scenarios to consider when it comes to access control. Allowing unauthorized access to risky operations or restricted areas results in a massive vulnerability. This highlights the importance of adding permissions in APIs.  

													
													
												

												
												

													
													
Django REST framework allows us to leverage permissions to define what can be accessed and what actions can be performed in a meaningful or common way. The permission checks always run at the beginning of every view. It uses the authentication information in the ‘request.user’ and ‘request.auth’ properties for each incoming request. If the permission check fails, then the view code will not run. 

													
													
												

												
												

													
													
Note: Together with authentication, permissions determine whether to grant or deny access for an incoming request. In this section, we will combine Basic Authentication with Django REST framework permission to set access control. You can refer Browsable API in Django REST Framework for Models, Serializers, and Views

													
													
												

												
												

													
													
Let’s dig deep into the Django REST framework permissions.

													
													
												

												
												

													
													
    

  • AllowAny
    • 

  • IsAuthenticated
    • 

  • IsAdminUser
    • 

  • IsAuthenticatedOrReadOnly
    • 

  • DjangoModelPermissions
    • 

  • DjangoModelPermissionsOrAnonReadOnly
    • 

  • DjangoObjectPermissions
    • 


													
													
												

												
											

										


										
										

											
Similar Reads

											
											

												
													

														AllowAny

													

														The AllowAny permission class will allow unrestricted access, irrespective of whether the request was authenticated or unauthenticated. Here the permission settings default to unrestricted access...
													

												
											

											
											

												
													

														IsAuthenticated

													

														...
													

												
											

											
											

												
													

														IsAdminUser

													

														...
													

												
											

											
											

												
													

														IsAuthenticatedOrReadOnly

													

														The IsAuthenticated permission class denies unauthenticated users to use the APIs for any operations. This ensures APIs accessibility only to registered users. Let’s use the IsAuthenticated class in our RESTful web service. Here, we can set the permission policy on a per-view basis. Let’s import and add the permission class in our RobotDetail and RobotList class. The code is as follows:...
													

												
											

											
											

												
													

														DjangoModelPermissions

													

														...
													

												
											

											
											

												
													

														DjangoModelPermissionsOrAnonReadOnly

													

														The IsAdminUser permission class will allow permission to users whose user.is_staff is True. This permission class ensures that the API is accessible to trusted administrators. Let’s make use of IsAdminUser permission class. Let’s import the permission class...
													

												
											

											
											

												
													

														DjangoObjectPermissions

													

														...
													

												
											

											
										


									

									

										
Tags:

										
										#Django-REST
										
										#Python Django
										
										#Articles
										
										#Python
										
										#python
										

									

									

										

											
											
												
												DjangoModelPermissions
											
											
										

										

											
											
												DjangoObjectPermissions