DRF Authentication Basics
In this page:
Authentication vs Permissions
Authentication answers 'who is this?' (e.g. checking a session cookie or token). Permissions answer 'what can this user do?' (e.g. only authenticated users may create a book). DRF separates the two so they can be mixed and matched.
Example: Authentication vs Permissions
Authentication answers 'who is this?' (e.g. checking a session cookie or token). Permissions answer 'what can this user do?' (e.g. only authenticated users may create a book). DRF separates the two so they can be mixed and matched.
# Authentication: identifies the user (or None for anonymous)
# Permissions: decides whether that user may perform this action
#
# request.user -> set by authentication
# IsAuthenticated, AllowAny, IsAdminUser -> examples of permissionsRequiring Authentication on a View
permission_classes on an APIView restricts access; IsAuthenticated rejects any request that isn't logged in with a 401/403 response.
Example: Requiring Authentication on a View
permission_classes on an APIView restricts access; IsAuthenticated rejects any request that isn't logged in with a 401/403 response.
from rest_framework.views import APIView
from rest_framework.permissions import IsAuthenticated
from rest_framework.response import Response
class BookListView(APIView):
permission_classes = [IsAuthenticated]
def get(self, request):
return Response({'message': f'Hello {request.user.username}'})Project-Wide Defaults
Instead of repeating permission_classes on every view, set defaults once in settings.py so all API views require authentication unless a view explicitly overrides it.
Example: Project-Wide Defaults
Instead of repeating permission_classes on every view, set defaults once in settings.py so all API views require authentication unless a view explicitly overrides it.
REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': [
'rest_framework.authentication.SessionAuthentication',
],
'DEFAULT_PERMISSION_CLASSES': [
'rest_framework.permissions.IsAuthenticated',
],
}- Enabling a permission class like IsAuthenticated without configuring any authentication class, so every request is rejected because DRF has no way to identify the user.
- Assuming Django's session login automatically protects API endpoints, when DRF views need their own authentication_classes/permission_classes configured.
- Hardcoding permissions per view instead of setting sensible project-wide defaults in settings.py, leading to inconsistent access rules across endpoints.
- Authentication identifies who is making a request; permissions decide what that identified user is allowed to do.
- DRF supports multiple authentication schemes, including SessionAuthentication (reuses Django's login) and TokenAuthentication (API tokens).
- DEFAULT_AUTHENTICATION_CLASSES and DEFAULT_PERMISSION_CLASSES in settings.py set project-wide defaults for every API view.
Chapter Quiz — Complete all 6 topics to unlock
0/6 topics done
Complete these topics first: