mirror of
https://github.com/encode/django-rest-framework.git
synced 2024-11-26 03:23:59 +03:00
Added an example of how to use authentication and throttling.
This commit is contained in:
parent
412727440b
commit
9871532746
66
docs/examples/permissions.rst
Normal file
66
docs/examples/permissions.rst
Normal file
|
@ -0,0 +1,66 @@
|
|||
Permissions
|
||||
===========
|
||||
|
||||
This example will show how you can protect your api by using authentication
|
||||
and how you can limit the amount of requests a user can do to a resource by setting
|
||||
a throttle to your view.
|
||||
|
||||
Authentication
|
||||
--------------
|
||||
|
||||
If you want to protect your api from unauthorized users, Django REST Framework
|
||||
offers you two default authentication methods:
|
||||
|
||||
* Basic Authentication
|
||||
* Django's session-based authentication
|
||||
|
||||
These authentication methods are by default enabled. But they are not used unless
|
||||
you specifically state that your view requires authentication.
|
||||
|
||||
To do this you just need to import the `Isauthenticated` class from the frameworks' `permissions` module.::
|
||||
|
||||
from djangorestframework.permissions import IsAuthenticated
|
||||
|
||||
Then you enable authentication by setting the right 'permission requirement' to the `permissions` class attribute of your View like
|
||||
the example View below.:
|
||||
|
||||
|
||||
.. literalinclude:: ../../examples/permissionsexample/views.py
|
||||
:pyobject: LoggedInExampleView
|
||||
|
||||
The `IsAuthenticated` permission will only let a user do a 'GET' if he is authenticated. Try it
|
||||
yourself on the live sandbox__
|
||||
|
||||
__ http://rest.ep.io/permissions-example/loggedin
|
||||
|
||||
|
||||
Throttling
|
||||
----------
|
||||
|
||||
If you want to limit the amount of requests a client is allowed to do on
|
||||
a resource, then you can set a 'throttle' to achieve this.
|
||||
|
||||
For this to work you'll need to import the `PerUserThrottling` class from the `permissions`
|
||||
module.::
|
||||
|
||||
from djangorestframework.permissions import PerUserThrottling
|
||||
|
||||
In the example below we have limited the amount of requests one 'client' or 'user'
|
||||
may do on our view to 10 requests per minute.:
|
||||
|
||||
.. literalinclude:: ../../examples/permissionsexample/views.py
|
||||
:pyobject: ThrottlingExampleView
|
||||
|
||||
Try it yourself on the live sandbox__.
|
||||
|
||||
__ http://rest.ep.io/permissions-example/throttling
|
||||
|
||||
Now if you want a view to require both aurhentication and throttling, you simply declare them
|
||||
both::
|
||||
|
||||
permissions = (PerUserThrottling, Isauthenticated)
|
||||
|
||||
To see what other throttles are available, have a look at the :doc:`../library/permissions` module.
|
||||
|
||||
If you want to implement your own authentication method, then refer to the :doc:`../library/authentication`
|
||||
module.
|
Loading…
Reference in New Issue
Block a user