BasePermission returning True for `has_permission` and `has_object_permission` is a huge gotcha #9778

jzwick-narmi · 2025-09-16T20:31:47Z

jzwick-narmi
Sep 16, 2025

When using the negation of a permission, for example an implementation of ~IsOAuthAuthentication, that BasePermission. has_object_permission returs a static True is a very tricky gotcha.

Where I would expect this permission to be False, the negation turning the condition to True, it winds up being False when checking object_permissions, so the negation that swaps it back to False, which ultimately fails the boolean evaluation.

BasePermission should look like this;

class BasePermission(metaclass=BasePermissionMetaclass):
    def has_permission(self, request, view):
        return True

    def has_object_permission(self, request, view, obj):
        return self.has_permission(request, view)

This will behave as one would intuitively expect both in the negated permission scenario, and the unnegated. It still returns True by "default", and if has_permission is ever False, it's likely not undesirable for has_object_permission to also be False.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

BasePermission returning True for `has_permission` and `has_object_permission` is a huge gotcha #9778

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Uh oh!

BasePermission returning True for has_permission and has_object_permission is a huge gotcha #9778

Uh oh!

Uh oh!

jzwick-narmi Sep 16, 2025

Replies: 0 comments

BasePermission returning True for `has_permission` and `has_object_permission` is a huge gotcha #9778

jzwick-narmi
Sep 16, 2025