DRF supports multiple authentication and permission schemes to secure APIs.

Authentication

DRF includes built-in authentication classes such as:

• SessionAuthentication: Uses Django’s session framework.
• TokenAuthentication: Uses tokens for authentication.
• BasicAuthentication: Uses HTTP Basic Authentication.

Example: Token Authentication

1. Install the Token Authentication module:

   pip install djangorestframework-simplejwt
   

2. Add it to settings.py:

   REST_FRAMEWORK['DEFAULT_AUTHENTICATION_CLASSES'] += [
       'rest_framework_simplejwt.authentication.JWTAuthentication',
   ]
   

3. Include authentication endpoints:

   from rest_framework_simplejwt.views import TokenObtainPairView, TokenRefreshView
   
   urlpatterns += [
       path('api/token/', TokenObtainPairView.as_view(), name='token_obtain_pair'),
       path('api/token/refresh/', TokenRefreshView.as_view(), name='token_refresh'),
   ]
   

Permissions

Permissions determine who can access the API. DRF provides built-in permissions like:

• AllowAny: Allows unrestricted access.
• IsAuthenticated: Requires users to be authenticated.
• IsAdminUser: Requires admin users.

Example: Custom Permission

Create a custom permission by subclassing BasePermission:

from rest_framework.permissions import BasePermission

class IsAuthor(BasePermission):
    def has_object_permission(self, request, view, obj):
        return obj.author == request.user

Apply the permission to a view:

from rest_framework.permissions import IsAuthenticated
from .permissions import IsAuthor

class PostDetailView(RetrieveUpdateDestroyAPIView):
    queryset = Post.objects.all()
    serializer_class = PostSerializer
    permission_classes = [IsAuthenticated, IsAuthor]