Difference between authentication classes and permission classes

[molten garden]

What is the difference between authentication classes and permission classes, and how are they related?

[glad adder]

well, the word "authentication" means "seeing if someone is who they say they are".

and the word "permission" means "seeing if someone is allowed to do something".

so you generally want to do both: first, figure out if someone is who they say they are (and if not, you tell them to drop dead); then once you're sure you know who they are, you see if they are allowed to do the thing they're trying to do.

[molten garden]

But how "IsAuthenticated" class connects to "JWTAuthentication"? What is the code flow?

[glad adder]

no idea. Never heard of those classes.

django has an is_authenticated method, fwiw

[lucid juniper]

I assume you're talking about DRF's IsAuthenticated permission class? That just checks whether request.user.is_authenticated is True

[lucid juniper]

attribute, if we're being picky about terms 😆

[glad adder]

are we? 🤔

[half tulip]

property? 🙉