title: Django - How can I prevent access to other users' objects?
body: <p>Let's assume that I have such URL <code>users/{id}/objects</code> and I am authenticated as a User with ID equals 1. At the moment I can access objects of users with ID equals 2, 3 etc. Does anyone have an idea how can I prevent this?</p>
  
  <pre><code>class UserObject(GenericAPIView):
  
      permission_classes = [UserPermission]
      def get(self, request, user_id):
  
              try:
                  object = Object.objects.filter(user=user_id)
              except Object.DoesNotExist:
                  return Response(status=status.HTTP_404_NOT_FOUND)
              serializer = ObjectSerializer(object, many=True)
              return Response(serializer.data)
  
  
  class UserPermission(permissions.BasePermission):
  
      def has_permission(self, request, view):
          if request.user and request.user.is_authenticated():
              return True
          return False
  </code></pre>
  
  <p>I tried in this way:</p>
  
  <pre><code>serializer_class = ObjectSerializer
  permission_classes = [IsAuthenticated, ]
  
  def get_queryset(self):
      return Object.objects.filter(owner=self.request.user)
  
  def get(self, request, user_id):
  
          try:
              object = Object.objects.filter(user=user_id)
          except Object.DoesNotExist:
              return Response(status=status.HTTP_404_NOT_FOUND)
          serializer = ObjectSerializer(object, many=True)
          return Response(serializer.data)
  </code></pre>