Django Academy · 课时

权限与限流

控制谁可以调用您的 API 以及调用频率

权限与限流 是 CoddyKit 上的免费 Django Academy 课时。这是第 2 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Django Academy 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Django Academy 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Who Can Call Your API?

An open API lets anyone read or change your data. Permissions decide who is allowed to do what on each endpoint.

The permission_classes Attribute

You attach access rules with permission_classes on a view or ViewSet. DRF checks them before any action runs.

from rest_framework.permissions import IsAuthenticated

class BookViewSet(viewsets.ModelViewSet):
    permission_classes = [IsAuthenticated]

Built-in Permission Classes

DRF ships ready rules: AllowAny opens a view, IsAuthenticated requires a logged-in user, and IsAdminUser limits it to staff.

Read for All, Write for Members

IsAuthenticatedOrReadOnly is a popular middle ground: anyone can GET, but only logged-in users can POST, PUT, or DELETE.

Setting a Default Globally

Set a project-wide rule in settings.py so every view starts secure unless it opts out.

REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.IsAuthenticated',
    ],
}

Writing a Custom Permission

Need your own rule? Subclass BasePermission and return True or False from has_permission for the request.

from rest_framework.permissions import BasePermission

class IsOwner(BasePermission):
    def has_object_permission(self, request, view, obj):
        return obj.owner == request.user

Object-Level Permissions

Use has_object_permission to check a single record, like letting users edit only the posts they own. 🔒

Now, Throttling

Permissions answer who. Throttling answers how often, capping the number of requests a client may send in a time window.

Anon vs User Throttles

DRF offers AnonRateThrottle for unauthenticated visitors and UserRateThrottle for logged-in accounts, so you can be stricter with strangers.

Configuring Rate Limits

Set the limits in settings with DEFAULT_THROTTLE_RATES, using a count plus a period like second, minute, hour, or day.

REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_RATES': {
        'anon': '20/hour',
        'user': '1000/day',
    },
}

What Throttling Protects

Throttling shields you from abuse and runaway scripts. When a client goes over, DRF returns a 429 Too Many Requests response. 🛡️

Quick Check

Let us confirm the difference between the two gatekeepers.

Recap: Access and Rate Limits

You can now gate endpoints with permission classes and protect them with throttle rates. Together they keep your API both safe and stable. 🎉

常见问题解答

「权限与限流」课时是免费的吗？

是的 — 「权限与限流」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Django Academy 课程的其余内容，请升级到 CoddyKit PRO。 Django Academy 课程共包含 4 节课。

「权限与限流」这节课中我会学到什么？

控制谁可以调用您的 API 以及调用频率你通过在浏览器中直接运行的动手代码来练习 Django Academy，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Django Academy 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Django Academy 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 2 节课，共 4 节。

「权限与限流」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Django Academy 课中编写并运行代码吗？

能。每节 Django Academy 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Django Academy