DRF Permission Classes
Permission classes decide access after authentication: has_permission() gates the view per-request, while has_object_permission() runs inside get_object() for per-instance rules like IsOwner, returning 403 (or 401 when unauthenticated) on failure. Built-ins compose with & and |; object-level checks never run on list views, so queryset filtering must handle collection visibility.
This Concept is waiting for its first lesson!
Permission classes decide access after authentication: has_permission() gates the view per-request, while has_object_permission() runs inside get_object() for per-instance rules like IsOwner, returning 403 (or 401 when unauthenticated) on failure. Built-ins compose with & and |; object-level checks never run on list views, so queryset filtering must handle collection visibility.
Are you a teacher? Sign in to start contributing.
Sign In