mirror of
				https://github.com/encode/django-rest-framework.git
				synced 2025-10-31 16:07:38 +03:00 
			
		
		
		
	Added an example of how to use authentication and throttling.
This commit is contained in:
		
							parent
							
								
									412727440b
								
							
						
					
					
						commit
						9871532746
					
				
							
								
								
									
										66
									
								
								docs/examples/permissions.rst
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										66
									
								
								docs/examples/permissions.rst
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,66 @@ | |||
| Permissions | ||||
| =========== | ||||
| 
 | ||||
| This example will show how you can protect your api by using authentication | ||||
| and how you can limit the amount of requests a user can do to a resource by setting | ||||
| a throttle to your view. | ||||
| 
 | ||||
| Authentication | ||||
| -------------- | ||||
| 
 | ||||
| If you want to protect your api from unauthorized users, Django REST Framework | ||||
| offers you two default authentication methods: | ||||
| 
 | ||||
|  * Basic Authentication | ||||
|  * Django's session-based authentication | ||||
| 
 | ||||
| These authentication methods are by default enabled. But they are not used unless  | ||||
| you specifically state that your view requires authentication.  | ||||
| 
 | ||||
| To do this you just need to import the `Isauthenticated` class from the frameworks' `permissions` module.:: | ||||
| 
 | ||||
|     from djangorestframework.permissions import IsAuthenticated | ||||
| 
 | ||||
| Then you enable authentication by setting the right 'permission requirement' to the `permissions` class attribute of your View like | ||||
| the example View below.: | ||||
| 
 | ||||
| 
 | ||||
| .. literalinclude:: ../../examples/permissionsexample/views.py | ||||
|    :pyobject: LoggedInExampleView | ||||
| 
 | ||||
| The `IsAuthenticated` permission will only let a user do a 'GET' if he is authenticated. Try it | ||||
| yourself on the live sandbox__ | ||||
| 
 | ||||
| __ http://rest.ep.io/permissions-example/loggedin | ||||
| 
 | ||||
| 
 | ||||
| Throttling | ||||
| ---------- | ||||
| 
 | ||||
| If you want to limit the amount of requests a client is allowed to do on  | ||||
| a resource, then you can set a 'throttle' to achieve this.  | ||||
| 
 | ||||
| For this to work you'll need to import the `PerUserThrottling` class from the `permissions` | ||||
| module.:: | ||||
| 
 | ||||
|     from djangorestframework.permissions import PerUserThrottling | ||||
| 
 | ||||
| In the example below we have limited the amount of requests one 'client' or 'user'  | ||||
| may do on our view to 10 requests per minute.: | ||||
| 
 | ||||
| .. literalinclude:: ../../examples/permissionsexample/views.py | ||||
|   :pyobject: ThrottlingExampleView | ||||
| 
 | ||||
| Try it yourself on the live sandbox__. | ||||
| 
 | ||||
| __ http://rest.ep.io/permissions-example/throttling | ||||
| 
 | ||||
| Now if you want a view to require both aurhentication and throttling, you simply declare them | ||||
| both:: | ||||
| 
 | ||||
|     permissions = (PerUserThrottling, Isauthenticated) | ||||
| 
 | ||||
| To see what other throttles are available, have a look at the :doc:`../library/permissions` module. | ||||
| 
 | ||||
| If you want to implement your own authentication method, then refer to the :doc:`../library/authentication`  | ||||
| module. | ||||
		Loading…
	
		Reference in New Issue
	
	Block a user