4 ms·
You may want to expose some fields that you don't allow changing, such as what account owns the resource. When fields are writable by default, it is easy for so
by alexbecker 10y ago
You may want to expose some fields that you don't allow changing, such as what account owns the resource. When fields are writable by default, it is easy for someone to miss that they've made a field writable when they just meant to expose it for reading.
- Kpourdeilami 10y agoI think it's better to define field specific read/write permissions through the serializers. In the serializer's Meta class, you can define a readonly_fields tuple containing the string names of the read only fields
- qnrq 10y agoYou can also route only read-only methods in urls.py, for example via: url( r'path/$', TheModelViewSetView.as_view({"get": "list"}), name="thename" ) or "retrieve" instead of "list" for a route which includes PK. This of course makes the entire path read-only so it's not a way to make some fields writable and others not.
- rtpg 10y agoyeah, I think they're saying instead of having the Meta fields list create writable fields by default, it should be read-only by default, after which you could add a "writable_fields" list