[Answer]-Django rest framework has_object_permission raising PermissionDenied exception

by

1👍

✅

You appear to be using a custom .get_serializer_class() method that is calling .get_object() for some reason.

File "/Users/mo/Projects/pythonic/dl-env/dlap/apps/account/views.py", line 96, in get_serializer_class
obj = self.get_object()

This is causing the per-object permission checks to be re-run when the Browsable API response is being rendered. Is it possible to reconsider your get_serializer_class implementation?

Edit: Note that you can probably simply inspect self.kargs[‘pk’] rather than actually calling through to get_object. It doesn’t look like you need to perform the full object retrieval in order to make the ownership check.

👤Tom Christie

Leave a comment