URL map

How to read the map

Protected

A recognized access control on every method: user_passes_test and what builds on it (login_required, staff_member_required, permission_required, the decorators of the project named after their variable), LoginRequiredMixin and its siblings, the DRF permission_classes other than AllowAny, the views served by the admin site (active staff account), and LoginRequiredMiddleware.

Hint in code

No recognized control, but the code of the view, or of a decorator or mixin of the project, holds is_authenticated, is_staff, PermissionDenied, HttpResponseForbidden, hmac… A hint to read, not a proof: a decorator may answer 403 for another reason than access. A control on some handlers only (method_decorator on post()) is a hint too. The VISUALIZE_URLS setting adds words to look for and names the decorators that do or do not control access.

No hint

Neither a recognized control nor a hint: a public page, or a control made elsewhere (middleware, template, a function the view calls). A view the map could not read counts here too, flagged “could not read” with the error.

csrf_exempt

Including the DRF views, exempted by APIView.as_view(); SessionAuthentication checks the CSRF token again.

Method

The map reads the URL resolver loaded in memory: nothing is read from the database. A decorator is named after its code (__code__), since functools.wraps gives the wrapper the name of the view. Third-party routes are declared and served by an installed package (admin, auth views…).