今天我们来看看rest_framework的APIView的权限验证过程是怎么走的。
一、 与认证的入口相似,权限验证也是从APIView的dispatch()到initial()方法,再到check_permissions(),通过返回True或者False来判断请求是否通过了权限验证:
def initial(self, request, *args, **kwargs):
self.format_kwarg = self.get_format_suffix(**kwargs)
neg = self.perform_content_negotiation(request)
request.accepted_renderer, request.accepted_media_type = neg
version, scheme = self.determine_version(request, *args, **kwargs)
request.version, request.versioning_scheme = version, scheme
self.perform_authentication(request