CODEWITHSUNDEEP
django-rest-framework
loar
loar

Reputation: 1765

DRF - Check user permissions

I want to check the permissions of the user in each method so, before the call reach the method handler the permissions must have been checked (DRY). According to the documentation initial enables me to do this but, is this a good practice?

class StorageDetail(APIView):

    def initial(self, request, *args, **kwargs):
        if not has_permission(request):
            return Response(status=status.HTTP_403_FORBIDDEN)

        super(StorageDetail, self).initial(request, *args, **kwargs)

    def post(self, request, storage_id):
        # ....

    def put(self, request, storage_id):
        # ...

Upvotes: 1

Views: 2518

Answers (1)

Raz
Raz

Reputation: 7923

No. It is not a good practice. According to the documentation it is better to use Permission class.

from rest_framework import permissions

class CustomerAccessPermission(permissions.BasePermission):
    message = 'Adding customers not allowed.'

    def has_permission(self, request, view):
        return True


class ExampleView(APIView):
    permission_classes = (IsAuthenticated, CustomerAccessPermission,)

Upvotes: 2

Related Questions