# Is there some restrictions on using request.user in django rest api?

**URL:** <https://forum.djangoproject.com/t/is-there-some-restrictions-on-using-request-user-in-django-rest-api/10928>\
**Category:** Using Django\
**Created:** [December 10, 2021, 3:23am UTC](https://forum.djangoproject.com/t/is-there-some-restrictions-on-using-request-user-in-django-rest-api/10928 "2021-12-10T03:23:43Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![CalvinTheCat](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/calvinthecat/32/5343_2.png) [@CalvinTheCat](https://forum.djangoproject.com/u/CalvinTheCat)\
**Post date:** [December 10, 2021, 3:23am UTC](https://forum.djangoproject.com/t/is-there-some-restrictions-on-using-request-user-in-django-rest-api/10928/1 "2021-12-10T03:23:43Z")

</div>

I have the following code:

```auto
@api_view(['GET'])
@authentication_classes([TokenAuthentication])
@permission_classes([IsAuthenticated])
def jobs(request):
    if request.user == 'admin':
        job = Job.objects.all()
        jobserializer = JobViewSeralizers(job, many = True)
        return Response(jobserializer.data)
    else:
        job = Job.objects.filter(owner = request.user)
        jobserializer = JobViewSeralizers(job, many = True)
        return Response(jobserializer.data)

```

When I use postman and log in as a normal user, `else` condition runs. But if i log in as admin user, `if` condition does not run. It still run `else` condition. Is there something wrong with my code for `if` condition?

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [December 10, 2021, 3:28am UTC](https://forum.djangoproject.com/t/is-there-some-restrictions-on-using-request-user-in-django-rest-api/10928/2 "2021-12-10T03:28:29Z")

</div>

Request.user is a reference to a User object, not just the login name of the user. See [Using the Django authentication system | Django documentation | Django](https://docs.djangoproject.com/en/3.2/topics/auth/default/#authentication-in-web-requests)

---

<div class="post-metadata">

**Author:** ![CalvinTheCat](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/calvinthecat/32/5343_2.png) [@CalvinTheCat](https://forum.djangoproject.com/u/CalvinTheCat)\
**Post date:** [December 10, 2021, 3:47am UTC](https://forum.djangoproject.com/t/is-there-some-restrictions-on-using-request-user-in-django-rest-api/10928/3 "2021-12-10T03:47:09Z")

</div>

I understand that it is a reference to User object. In the case of my code, if i logged in using admin account, the else condition will run and it will filter `owner == request.user`. In this case, `request.user` will have `admin` stored as i logged in with admin account and the output will show those jobs that `owner == admin` . But why I cannot put this `request.user=='admin'` as a condition?

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [December 10, 2021, 3:48am UTC](https://forum.djangoproject.com/t/is-there-some-restrictions-on-using-request-user-in-django-rest-api/10928/4 "2021-12-10T03:48:35Z")

</div>

Because `request.user` is an object of type User, while `'admin'` is a String. The two are never going to be equal. See the referenced docs.

> [@CalvinTheCat](#):
>
> In this case, `request.user` will have `admin` stored

This is not a correct statement. The variable, `request.user` will have a reference to the User object having a username of `admin`.

---

<div class="post-metadata">

**Author:** ![CalvinTheCat](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/calvinthecat/32/5343_2.png) [@CalvinTheCat](https://forum.djangoproject.com/u/CalvinTheCat)\
**Post date:** [December 10, 2021, 4:09am UTC](https://forum.djangoproject.com/t/is-there-some-restrictions-on-using-request-user-in-django-rest-api/10928/5 "2021-12-10T04:09:42Z")

</div>

I think i kind of get it. Thank you very much! I dont know if this is the right way but it worked:

```auto
@api_view(['GET'])
@authentication_classes([TokenAuthentication])
@permission_classes([IsAuthenticated])
def jobs(request):
    currentuser=request.user
    
    print(type(currentuser))
    user = str(currentuser)
    print(type(user))
    if user == 'admin':
        job = Job.objects.all()
        jobserializer = JobViewSeralizers(job, many = True)
        return Response(jobserializer.data)
    else:
        job = Job.objects.filter(owner = request.user)
        jobserializer = JobViewSeralizers(job, many = True)
        return Response(jobserializer.data)

```

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [December 10, 2021, 4:17am UTC](https://forum.djangoproject.com/t/is-there-some-restrictions-on-using-request-user-in-django-rest-api/10928/6 "2021-12-10T04:17:28Z")

</div>

Sorry, that’s dangerously wrong.

In addition to the above, see [Using the Django authentication system | Django documentation | Django](https://docs.djangoproject.com/en/3.2/topics/auth/default/#user-objects)  
and [django.contrib.auth | Django documentation | Django](https://docs.djangoproject.com/en/3.2/ref/contrib/auth/#fields)

One attribute you could look for is the `username` attribute of the User object. In other words `request.user.username == 'admin'`. That’s still “wrong”, but less so than your approach.

A production-quality deployment will generally have more than one superuser account. What you probably want to check is [`is_superuser`](https://docs.djangoproject.com/en/3.2/ref/contrib/auth/#django.contrib.auth.models.User.is_superuser). e.g. `if request.user.is_superuser:`

---

<div class="post-metadata">

**Author:** ![CalvinTheCat](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/calvinthecat/32/5343_2.png) [@CalvinTheCat](https://forum.djangoproject.com/u/CalvinTheCat)\
**Post date:** [December 10, 2021, 4:25am UTC](https://forum.djangoproject.com/t/is-there-some-restrictions-on-using-request-user-in-django-rest-api/10928/7 "2021-12-10T04:25:13Z")

</div>

May I ask how come is dangerously wrong? It is some security issue? But thanks for linking the fields for me. I forget about `is_superuser` field.

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [December 10, 2021, 4:37am UTC](https://forum.djangoproject.com/t/is-there-some-restrictions-on-using-request-user-in-django-rest-api/10928/8 "2021-12-10T04:37:14Z")

</div>

Because you’re tying an authorization function to an implementation of an api (the `str` method of the User object) that is not necessarily “stable”.

There is no documented requirement that `print(user)` always return only the `username` field. It’s possible that the next version of Django changes AbstractBaseUser from:

```auto
    def __str__ (self):
        return self.get_username()

```

to:

```auto
    def __str__ (self):
        return "User: "+self.get_username()

```

and your system breaks.

When there are valid APIs for performing a given function, there’s no reason for using an invalid API just because it currently happens to work.

---

<div class="post-metadata">

**Author:** ![CalvinTheCat](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/calvinthecat/32/5343_2.png) [@CalvinTheCat](https://forum.djangoproject.com/u/CalvinTheCat)\
**Post date:** [December 10, 2021, 7:00am UTC](https://forum.djangoproject.com/t/is-there-some-restrictions-on-using-request-user-in-django-rest-api/10928/9 "2021-12-10T07:00:42Z")

</div>

Oh okay. Thanks for the clear explanation !