In the previous video, we discover how to create a token.
And now I will show you how we can use that token to secure our application.
So let's come back to our PyCharm and we can close.
That URLs we don't use it anymore and you can close all of that.
So basically in our settings we can set up a setting for our rest framework.
At the moment we don't have anything here yet.
So in any place you like we can add a setting, especially for rest framework.
So we do all capital rest, underscore framework like that and then we'll include some configuration
inside.
And we gonna do default.
Permission classes.
And then.
We can pass a tuple array of different permissions.
I will do a new line here.
And then capital rest.
Framework.
Permissions and then we can decide what permission we would like to have it.
So I will start is with is authenticated.
That's case sensitive.
So rest framework permissions is authenticated.
I'll put a comma at the very end.
That's very important because we need to we need to tell Python that this is actually array a tuple
that we'll use.
Otherwise it will be treated as a single record and it will throw an error for us.
So wherever you have a tuple to make sure that python will treat as tuple puts the command the very
end.
So rest framework, permission is authenticated, we add it like that.
And as you can see here, that's a default in the settings.
So that means that we would like to use as default is authenticated.
So we restrict our application to be used only by authenticated users.
So I will run it again.
And now its server is running.
Let's go back to the postman here and then let's try to use this one of the one of the calls we use
before.
So as you can see here, if I click this on the books, this is what we use before I have another tab
here when I click it.
So this one is still there.
I have another tab, which is a demo books and I will try to use the get before we had a list of all
the books in our database.
So if I will do it now, you can see here authentication credentials were not provided.
The reason for this message being displayed is this.
So the default permission for our whole project is is intoxicated.
So that means I restrict everything in our my application to be authenticated.
So what we need to actually do to get some records and I will show you so we have that token that we
can actually use.
So normally what we need to do is we go to the headers and inside headers we need to attach our theorization.
So the key here is authorization and the value is capital token, then space, and then we can paste
in that long string.
So we don't have much space here.
So it will go to double line and it doesn't really matter.
But the syntax is token space and the long string that we got it from here.
So you can see we have this token, I just copy that and put it inside the headers in authorization
token space and the string, if I will send it.
Now what we could expect is to have the result back, but it's not going to work.
And I will show you in a second why.
So I will send it now.
And you can see nothing has been changed despite the fact we are sending the token with to get our books.
What we need to do is we need to come back to our Django.
And inside the views here, we need to tell that this view set will use that authentication classes
and here we can provide here, give it a token authentication.
First, we'll need to import it.
So from rest framework authentication, import token authentication and that token authentication,
I can pass it here.
I also need to provide that extra comma for python to treat it as a tuple, otherwise it will be treated
as a single record.
And we need to be an array because authentication classes expect might have more than one value.
So actually you can pass as many as you like.
So that's what we have now, our authentication classes.
And then we say token authentication, use it for this view.
And then I will refresh it here and then we can come back to our postman.
And then let's try it again.
We still have that authorization and token and I will send it get.
And in this case, you can see I'm getting my two books from the database because I provide that authorization
token here.
If I will disable this for now and this time when I click send, it is without the authorization.
So you can see here authentication credentials were not provided if I include it.
I have all the books.
So in that case, what I'm doing is I'm restricting to see a list of the books for people who has authorization
and only people with a token.
That means they need to have an account in our system.
They will get the list there.
So that's the way to restrict it.
What else can we do in the settings we change?
It here is authenticated.
That's not the only method we have in the documentation.
We might have a more methods, but I will show you, show you another one.
Allow any like that.
So if I will change it here.
And come back to our application.
And then if I will send it here, nothing changed because I provide authentication.
If I disable this authentication and send it, you can see I still see a list of books because my default.
In the settings.
My default permission classes is allow any.
That means everyone can see anything in my application.
But despite the fact that default might be halloweeny, I can still override it here for this specific
view set.
So what I can do is I can do permission classes and here I can do is authenticated as we had it before,
so I need to import it first.
So from rest framework.
Permissions.
Is authenticated.
You can see here, actually, we have more options.
So this admin user is authenticated or read only and so on and so on.
So you can actually see some references there.
I will use this and dedicated like that and I will pass it here.
Also make it a double.
So this time my default one I said allow any so my application will be open to anyone, but this specific
view set will be owned is authenticated.
So I will save this here, come back to my postman and then let's try to get the list of the books without
a token.
Sending.
And I need to provide it with the token.
I get it.
All right.
So that proves the way.
How we can actually secure it and have a full control over our resources in the database.
So in our case, we have only one view set, but you might have multiple models, multiple view sets,
and you can restrict them by view set.
So you might say my application is allowing any to see everything, but you might have some resources
that you will restricted or other way around.
You will restrict everything here and if you want to open something you can do, allow any here as well.
So this is the way to control the access to our application.