Permissions For Createapiview In Django Rest Framework

I looked at the code for CreateAPIView and nowhere in the creation process are permissions checked. So I decided to check them in the perform_create hook as follows: class CourseLi

Solution 1:

You have an issue because you're tying business logic checks with permissions.

Instead of calling check_object_permission, perform your own check once it's deserialized and raise a PermissionDenied if it fails.