What is Django Authentication?

Django provides a built-in authentication system that handles user accounts, groups, permissions, and cookie-based user sessions. It's ready to use out of the box.

User Model

Django's default User model:

from django.contrib.auth.models import User

# Create user
user = User.objects.create_user(
    username='alice',
    email='[email protected]',
    password='securepassword'
)

# Check password
user.check_password('securepassword')  # True

User Registration

Create registration view:

from django.contrib.auth import login
from django.shortcuts import render, redirect

def register(request):
    if request.method == 'POST':
        username = request.POST['username']
        email = request.POST['email']
        password = request.POST['password']
        
        user = User.objects.create_user(username, email, password)
        login(request, user)
        return redirect('home')
    
    return render(request, 'register.html')

User Login

Authenticate and log in users:

from django.contrib.auth import authenticate, login

def login_view(request):
    if request.method == 'POST':
        username = request.POST['username']
        password = request.POST['password']
        
        user = authenticate(request, username=username, password=password)
        if user is not None:
            login(request, user)
            return redirect('home')
        else:
            return render(request, 'login.html', {'error': 'Invalid credentials'})
    
    return render(request, 'login.html')

User Logout

Log out users:

from django.contrib.auth import logout

def logout_view(request):
    logout(request)
    return redirect('home')

Checking Authentication

Check if user is logged in:

# In views
if request.user.is_authenticated:
    # User is logged in
    pass

# In templates
{% if user.is_authenticated %}
    <p>Welcome, {{ user.username }}!</p>
{% else %}
    <p>Please log in.</p>
{% endif %}

Login Required Decorator

Protect views with decorator:

from django.contrib.auth.decorators import login_required

@login_required
def profile(request):
    return render(request, 'profile.html')

# Redirects to login if not authenticated
# Default login URL: /accounts/login/

User Permissions

Check user permissions:

# Check permission
if request.user.has_perm('app.add_model'):
    # User can add model
    pass

# Check if superuser
if request.user.is_superuser:
    # Admin user
    pass

Password Management

Handle password changes:

from django.contrib.auth import update_session_auth_hash

def change_password(request):
    if request.method == 'POST':
        form = PasswordChangeForm(request.user, request.POST)
        if form.is_valid():
            user = form.save()
            update_session_auth_hash(request, user)
            return redirect('profile')
    else:
        form = PasswordChangeForm(request.user)
    return render(request, 'change_password.html', {'form': form})

Best Practices

  • Use built-in views: Django provides login/logout views
  • Hash passwords: Never store plain passwords
  • Use @login_required: Protect sensitive views
  • Check permissions: Verify user has required permissions
  • Secure sessions: Use HTTPS in production

Next Steps

Learn about Django Views to implement authentication, or explore forms for login/registration.