Okay so now we've created a working user
profile API. We tested that you can
create new profiles and you can modify
profiles and you can list profiles in
the system. But you may have noticed one
fundamental flaw in our profiles API and
that is that there is no security
applied to the API at all. That means
that as it stands anyone can use the
API to update any profile. This poses an
obvious security risk to our system so
we're going to fix that by creating a
permissions class and applying it to our
user profile viewset. Let's start by
heading over to atom and creating a new
file within our profiles API location.
We're going to call this file
permissions.py. This is where we're going
to store all of the permission classes
for our application. A permissions class
is a class that Django rest framework
uses to determine if the user has the
permission to make the change they're asking.
So each time the request is made to
our API Django rest framework can check
the permissions classes and ensure that
the request that they're making
is a legal request. So that is that the
user making the request has the correct
permissions to make the changes they're
asking for. We create permission classes
by inheriting from the base permissions
class that comes with the Django rest
framework. So let's start by importing
the base permissions class or importing
the permissions module which includes
the basic mission class at the top of
our permissions file. Start by typing:
from rest_framework import permissions
the permissions module
contains all of the base permission
classes in the Django rest framework
Underneath that let's create a new class
called the update own profile
permissions class. We're going to inherit
from permissions.BasePermissions
So start typing: class UpdateOwnProfile
and inherit from permissions.BasePermission
underneath that right the doc
string "Allow users to edit their own
profile." Okay so the way that permission
classes work is there's a function
inside the permission class called has
object permission. This function is
called every time a request is made to
our API the result of that function
determines whether the user has the
permission or doesn't have the
permission to perform the action. So this
has object permission function returns a
simple true or false depending on what
the result of the permission is. Let's
define our has object permission class
here so type: def has_object_permission
and in the parameters we're
going to add self, request, view, obj
below that definition put
a doc string "Check user is trying to
edit their own profile." Okay so the first
thing that we want to do with this
permission is we want to allow users to
be able to view any profile in the
system so we don't want to apply any
permissions if the user is trying to just
simply view a profile. We do this by
checking the safe methods list that's
provided by the Django rest framework. A
safe method is a HTTP method that is
classified as safe. That is that is a
non-destructive method so it allows you
to retrieve data but it doesn't allow
you to change or modify or delete any
objects in the system. So a safe method
is HTTP GET
We're going to check the permissions.SAFE_METHODS
list against the request
that was made and if it's in the safe
methods we're going to return true.
Because we can allow users to view other
users in the system. So type:
if request.method in permissions.SAFE_METHODS
return true.
So the request object is passed in when the
has_object_permission function is
called from our viewset. The request
object includes the type of request that
was made to the API. This includes the
method that was used so we're checking
here if the method that was used to make
the request is in the safe
methods permissions of the
Django rest framework then return True.
Next we're going to check if the user is
updating their own profile. So basically
if this is false so it's not a safe
method then we're not going to run
return True we're going to skip to the
next section of the code and in this
section we need to check that the user
is trying to make the change on their
own profile. So we know at this point
that they're not requesting a safe
method so they're not simply trying to
view a profile. They want to either
delete update or change a profile. So
we're going to return here we're going
to type: return obj.id == request.user.id
So what we're doing here is returning this comparison so the
comparison is checking that the object
the user is trying to change has the
same ID of the user that's currently
authenticated in the system. So the
object ID would be for example the
profile ID. The user ID that is
authenticated is this request.user.id
So if the object ID
equals the profile ID it will
automatically return true if the object
ID that the user is trying to change
does not equal the authenticated user ID
of the request then this will return
false and the permission will be denied.
Okay so that's how you create a
permission file in the Django rest
framework. Save the file and thank you
for watching and I'll see you in the
next lesson.