{"action":"created","issue":{"url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3751","labels_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3751/labels{/name}","comments_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3751/comments","events_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3751/events","html_url":"https://github.com/tomchristie/django-rest-framework/issues/3751","id":122590051,"number":3751,"title":"OPTIONS shows all possible foreign keys in choices field","user":{"login":"mlissner","id":236970,"avatar_url":"https://avatars.githubusercontent.com/u/236970?v=3","gravatar_id":"","url":"https://api.github.com/users/mlissner","html_url":"https://github.com/mlissner","followers_url":"https://api.github.com/users/mlissner/followers","following_url":"https://api.github.com/users/mlissner/following{/other_user}","gists_url":"https://api.github.com/users/mlissner/gists{/gist_id}","starred_url":"https://api.github.com/users/mlissner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mlissner/subscriptions","organizations_url":"https://api.github.com/users/mlissner/orgs","repos_url":"https://api.github.com/users/mlissner/repos","events_url":"https://api.github.com/users/mlissner/events{/privacy}","received_events_url":"https://api.github.com/users/mlissner/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-16T20:03:39Z","updated_at":"2015-12-16T23:43:27Z","closed_at":null,"body":"I have an object with foreign keys and when I load a `OPTIONS` request for that object type, it shows me a truly insane JSON object with every possible value for the foreign key (there are millions!)\r\n\r\nSo, for example, I have this object:\r\n\r\n    class OpinionCluster(models.Model):\r\n        \"\"\"A class representing a cluster of court opinions.\"\"\"\r\n        docket = models.ForeignKey(\r\n            Docket,\r\n            help_text=\"The docket that the opinion cluster is a part of\",\r\n            related_name=\"clusters\",\r\n        )\r\n\r\nWhich is serialized with:\r\n\r\n```python\r\nclass OpinionClusterSerializer(serializers.HyperlinkedModelSerializer):\r\n    docket = serializers.HyperlinkedRelatedField(\r\n        many=False,\r\n        view_name='docket-detail',\r\n        queryset=Docket.objects.all(),\r\n        style={'base_template': 'input.html'},\r\n    )\r\n```\r\n\r\nWhen I load this with `OPTIONS`, I get back something that contains:\r\n\r\n```json\r\n    \"docket\": {\r\n        \"type\": \"field\",\r\n         \"required\": true,\r\n         \"read_only\": false,\r\n         \"label\": \"Docket\",\r\n         \"choices\": [\r\n            {\r\n                \"display_name\": \"4: United States v. Goodwin\",\r\n                \"value\": \"http://127.0.0.1:8000/api/rest/v3/dockets/4/\"\r\n            },\r\n            {\r\n                \"display_name\": \"5: Quality Cleaning Products v. SCA Tissue of North America\",\r\n                \"value\": \"http://127.0.0.1:8000/api/rest/v3/dockets/5/\"\r\n            },\r\n\r\n....millions more....\r\n```\r\n\r\nI know that there's a way to [disable listing these items][1] in the form of the HTML view, but in the OPTIONS request we need better default functionality than displaying millions of records.\r\n\r\n[1]: http://www.django-rest-framework.org/api-guide/relations/#select-field-cutoffs"},"comment":{"url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/comments/165289133","html_url":"https://github.com/tomchristie/django-rest-framework/issues/3751#issuecomment-165289133","issue_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3751","id":165289133,"user":{"login":"mlissner","id":236970,"avatar_url":"https://avatars.githubusercontent.com/u/236970?v=3","gravatar_id":"","url":"https://api.github.com/users/mlissner","html_url":"https://github.com/mlissner","followers_url":"https://api.github.com/users/mlissner/followers","following_url":"https://api.github.com/users/mlissner/following{/other_user}","gists_url":"https://api.github.com/users/mlissner/gists{/gist_id}","starred_url":"https://api.github.com/users/mlissner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mlissner/subscriptions","organizations_url":"https://api.github.com/users/mlissner/orgs","repos_url":"https://api.github.com/users/mlissner/repos","events_url":"https://api.github.com/users/mlissner/events{/privacy}","received_events_url":"https://api.github.com/users/mlissner/received_events","type":"User","site_admin":false},"created_at":"2015-12-16T23:43:27Z","updated_at":"2015-12-16T23:43:27Z","body":"I made an attempt at resolving this by overwriting the metadata class as mentioned above, but that doesn't work because all you can do at that stage is remove data that's already been pulled from the DB. Meaning: If you do this, you still fetch millions of objects from the DB, you just don't pass those values to the front end.\r\n\r\nThe fix for this, unless I'm mistaken, is one of:\r\n\r\n - Remove the OPTIONS request from the API (Sad, but would work)\r\n - Make the endpoints read_only (Sad, breaks the API)\r\n - Some sort of fix in DRF\r\n\r\nThanks for any help or other ideas.\r\n"}}