What is the difference between authentication and permissions in Django REST Framework?
Understand the difference between authentication and permissions in Django REST Framework, how they run in order, and when DRF returns 401 vs 403 responses.
Expected Interview Answer
In Django REST Framework, authentication establishes WHO the requester is (it identifies the user and populates request.user), while permissions decide WHAT that identified user is allowed to do on a given endpoint. Authentication runs first; permissions run afterwards on the result.
Authentication classes (like TokenAuthentication, SessionAuthentication, or JWT) inspect the incoming request, verify credentials, and set request.user and request.auth — or leave the user anonymous if no valid credentials are supplied. Permission classes (like IsAuthenticated, IsAdminUser, DjangoModelPermissions, or a custom BasePermission) then run has_permission and has_object_permission checks to allow or reject the request with 401 or 403. Authentication never grants access by itself; it only proves identity, and permissions turn that identity into an allow/deny decision per view or per object.
- Cleanly separates identity from authorization
- Lets one auth scheme back many different permission rules
- Supports per-view and per-object access control
- Returns correct 401 (who are you?) vs 403 (not allowed) responses
- Pluggable classes configured globally or per view
AI Mentor Explanation
Authentication is the security gate scanning a player's accreditation pass to confirm they really are that player, while permissions are the zone markings that decide whether that verified player may enter the dressing room, the pitch, or only the stands. The gate proves identity; the zone rules govern access.
Step-by-Step Explanation
Step 1
Request arrives
DRF hands the incoming request to the configured authentication classes before the view logic runs.
Step 2
Authenticate
Each authentication class inspects headers or cookies; the first that succeeds sets request.user and request.auth.
Step 3
Fallback to anonymous
If no authenticator succeeds, request.user becomes AnonymousUser rather than raising an error immediately.
Step 4
Check permissions
Every permission class runs has_permission; object-level views also run has_object_permission.
Step 5
Allow or deny
If all permissions pass the view executes; otherwise DRF returns 401 (unauthenticated) or 403 (forbidden).
What Interviewer Expects
- Authentication = identity, permissions = authorization
- Order: authentication runs before permission checks
- Knowledge of common classes (TokenAuthentication, IsAuthenticated, etc.)
- Difference between 401 and 403 responses
- Awareness of has_permission vs has_object_permission
Common Mistakes
- Thinking authentication alone grants access to an endpoint
- Confusing 401 (unauthenticated) with 403 (forbidden)
- Forgetting object-level permissions need has_object_permission
- Assuming IsAuthenticated checks roles rather than just login state
- Mixing up the DEFAULT_AUTHENTICATION_CLASSES and DEFAULT_PERMISSION_CLASSES settings
Best Answer (HR Friendly)
“Authentication is how the system confirms who you are, like showing your ID at a door. Permissions then decide what you are actually allowed to do once your identity is known. In Django REST Framework, the app checks who you are first, then separately checks whether that person is allowed to perform the requested action.”
Code Example
from rest_framework.authentication import TokenAuthentication
from rest_framework.permissions import IsAuthenticated
from rest_framework.views import APIView
from rest_framework.response import Response
class OrderListView(APIView):
# WHO you are: verify the token and set request.user
authentication_classes = [TokenAuthentication]
# WHAT you can do: only identified users may proceed
permission_classes = [IsAuthenticated]
def get(self, request):
orders = request.user.orders.all()
return Response({'count': orders.count()})Follow-up Questions
- How do has_permission and has_object_permission differ?
- When does DRF return 401 versus 403?
- How would you write a custom permission class?
- How do DEFAULT_AUTHENTICATION_CLASSES and DEFAULT_PERMISSION_CLASSES work together?
- How does token authentication differ from session authentication in DRF?
MCQ Practice
1. In DRF, what does an authentication class primarily do?
Authentication classes verify credentials and populate request.user and request.auth; they do not grant action-level access.
2. A logged-in user is blocked from an admin-only endpoint. Which status code is correct?
The user is authenticated but not authorized, so DRF returns 403 Forbidden rather than 401.
3. Which method enforces per-object access in a DRF permission class?
has_object_permission runs after has_permission to authorize access to a specific object instance.
Flash Cards
What does authentication answer? — Who is making the request — it identifies the user and sets request.user.
What do permissions answer? — Whether the identified user is allowed to perform the requested action.
Which runs first? — Authentication runs before permission checks in the DRF request cycle.
401 vs 403? — 401 means not authenticated (unknown identity); 403 means authenticated but not permitted.
Continue Learning
Related Interview Questions
How does Django's authentication system work?
medium
How do you write custom Django middleware and why does MIDDLEWARE ordering matter?
medium
How do you structure Django settings and manage secrets safely across environments?
medium
Why should you set AUTH_USER_MODEL at the start of a project, and how do you extend the user model later?
medium