title: Check permissions before getting object in Django REST
body: <p>Using the Django REST framework, I use this view and permission to allow only project owners to get their projects.</p>
  
  <p>view.py</p>
  
  <pre><code>class ProjectViewSet(viewsets.ModelViewSet):
      permission_classes = (
         IsProjectOwner, 
         permissions.IsAuthenticated,
         )
  
      def get_queryset(self):
         return Project.objects.filter(owner=self.request.user)
  </code></pre>
  
  <p>permissions.py</p>
  
  <pre><code>class IsProjectOwner(permissions.BasePermission):
      def has_object_permission(self, request, view, obj):
          return obj.owner == request.user
  </code></pre>
  
  <p>When an user tries to get a project which does not belong to him, a HTTP 404 arises. However, I would like to get HTTP 403_Forbidden. Here is the test I use </p>
  
  <pre><code>    def test_auth_get(self):
          self.client.credentials(
              HTTP_AUTHORIZATION=self.authenticated_user_token
              ) 
  
          response = self.client.get(
              '/-/projects/%s/' % self.project_owner_project_id
              )
  
          self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
  </code></pre>
  
  <p>I tried to solve the problem using a get_object() method like in the REST docu <a href="http://www.django-rest-framework.org/api-guide/permissions/#object-level-permissions" rel="noreferrer">http://www.django-rest-framework.org/api-guide/permissions/#object-level-permissions</a>. But I am not sure how to check the permission before knowing the actual object.</p>