Django authentication and permissions
<p>I posted a question on SO regarding Django authentication and permissions even though it's already there. My question is ,</p>

<p>I have a backend ready with a lot of views, models and serializers from DRF. Now I want to apply authentication to my app and create RESTful apis that are consumed at the front-end. So the doubts that I have</p>

<ul>
<li>How does authentication work? Does Django create different model tables for each of its user?</li>
<li>If so, how do I retrieve data per user from Django?</li>
</ul>

<p>Now comes the second case</p>

<ul>
<li>If above two are true, then how do I use permission in DRF to serve only the data that is relevant to a particular user?</li>
</ul>

<p>I hope my questions are clear. If not, suggest me edits.
I'd also like some examples(if any) on how does this all happens.</p>

<p>Also, if you want to see the <a href="http://stackoverflow.com/questions/39484907/django-authentication-with-drf">original post</a>.</p>

<blockquote>
  <p>How does authentication work? Does Django create different model tables for each of its user?</p>
</blockquote>

<p>No, Django does not create different model tables for each of its users. The users itself are stored as entry in the <code>User</code>-Model. So to have data for each user you have to add a foreign-key in your data model to a particular user.</p>

<pre><code>class Post(models.Model):
    author = models.ForeignKey(settings.AUTH_USER_MODEL)
    text = models.TextField()
</code></pre>

<p>So once your user is logged in (authenticated) you simply filter the Post-model according to the logged in user.
In DRF you can do this filtering with permissions:</p>

<pre><code>class PostList(generics.ListCreateAPIView):
    queryset = Post.objects.all()
    serializer_class = PostSerializer
    permission_classes = (IsOwner,)


class IsOwner(permissions.BasePermission):
    """
    Custom permission to only allow owners of an object to see it.
    """

    def has_object_permission(self, request, view, obj):
        return obj.author == request.user
</code></pre>

<p>I hope this helps</p>

python django django-rest-framework