[Fixed]-Django REST framework checks unnecessary permissions

1👍

So the answer was more simple than I thought. Basically this problem only occurs when using the browsable API. During rendering of the template there are many template tags for forms that use each kind of request specified in the View class (post,put,delete, etc.) and the object permissions is checked for each form individually. When I used pure json format everything started to work as it should, no unnecessary checks etc.

There is however one issue. The browsable api checks permissions for every object fetched which in turn creates an issue: you don’t know what is the class of obj in has_object_permission(self, request, view, obj) so you should make an explicit check or the APIView will throw a TypeError

Leave a comment