REST Easy — API Security Done Right
summary
Claim: small, composable permission classes plus a composer make complex API rules tractable. Uses Django REST Framework serializers/views and multiple auth methods (session auth JWT tokens API keys signed URLs), a homemade field restriction helper (factory that limits writable model columns), and the pip-installable rest_condition composer to AND/OR permission pieces. Implements is_post is_authenticated has_object_permission and get_queryset filters. Built code runs in production but exposes messy, scattered logic and past security bugs, so a centralized role-based permissions model is proposed.
AI-written summary · about
chapters (7)
- 0:00Introduction to rest security
- 2:00The evolving role of web apps
- 4:26State of Django rest framework
- 6:26API security considerations
- 10:00Strategies for secure APIs
- 14:44Using rest condition
- 17:18Future of api security
related talks
29mDefence in depth
51mAuthorization beyond @RolesAllowed
21mSecuring Backstage Plugins Using the Permissions Framework
31mAuthorised is Not a Yes No Question
48mPractical Django Secuirty
17mAPI Security Simplified: Practical Tips & Tools
23mAuthorization in GraphQL: Peanut Butter and Chocolate
15mDjango URL Pattern Role Authorization System