Django & DRF Mastery: Build Robust Web Apps & APIs from Scratch

Who Are You? What Can You Do? The Pillars of Web Security

Almost every real-world web application needs to manage users. Whether it's a social network, an e-commerce store, or a blog with multiple authors, you need to know:

• Who is visiting my site? (Are they a returning user, or a new guest?)
• Are they who they claim to be? (Is that really Alice logging in, or someone else?)
• What are they allowed to do? (Can Alice publish a post? Can Bob delete a comment?)

Building a secure and robust user management system from scratch is incredibly complex and prone to security vulnerabilities (think password hashing, session management, protecting against common attacks). Fortunately, Django comes with a battle-tested, built-in system for Authentication and Authorization that handles most of this heavy lifting for you.

At UdaanPath.com, we empower you to build secure applications by leveraging Django's robust features. This module will show you how to quickly implement user logins, protect sensitive views, and control user permissions, all with minimal code.

Authentication in Action: Login, Logout, and Protecting Views

1. Setting up Auth URLs in `mysite/urls.py`

Django provides a set of authentication views that you can easily include.

# mysite/urls.py
from django.contrib import admin
from django.urls import path, include
from django.conf import settings
from django.conf.urls.static import static

urlpatterns = [
    path('admin/', admin.site.urls),
    path('blog/', include('blog.urls')),
    path('accounts/', include('django.contrib.auth.urls')), # Includes login, logout, password change/reset
    # Add a custom path for a success page after login/logout, if needed
    path('accounts/profile/', include('blog.urls')), # Example: redirect to blog's home after login
]

if settings.DEBUG:
    urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)
            

By including `django.contrib.auth.urls`, you automatically get URLs like `/accounts/login/`, `/accounts/logout/`, `/accounts/password_change/`, etc.

2. Configuring Login/Logout Redirects in `settings.py`

Tell Django where to redirect users after logging in or out.

# mysite/settings.py
# ...
LOGIN_REDIRECT_URL = '/blog/posts/' # Where to go after successful login (using a URL path)
LOGOUT_REDIRECT_URL = '/blog/posts/' # Where to go after successful logout
# You can also use named URLs:
# LOGIN_REDIRECT_URL = 'blog:post_list' # Assuming 'post_list' is a named URL in blog/urls.py
# LOGOUT_REDIRECT_URL = 'blog:post_list'
            

3. Creating Authentication Templates

Django's auth views look for templates in specific locations by default. Create a `registration` folder inside your `blog/templates` directory (i.e., `blog/templates/registration/`).

`blog/templates/registration/login.html` (for the login page):

<!-- blog/templates/registration/login.html -->
{% extends "blog/base.html" %}

{% block title %}Log In{% endblock %}

{% block content %}
<h2>Log In</h2>
<form method="post" action="{% url 'login' %}">
    {% csrf_token %}
    {{ form.as_p }} <!-- Render login form fields -->
    <button type="submit">Log In</button>
</form>
<p>Don't have an account? <a href="{% url 'admin:auth_user_add' %}">Sign Up (Admin demo)</a></p>
<!-- For a real user signup, you'd create a custom form and view -->
{% endblock %}
            

`blog/templates/registration/logged_out.html` (for the logout success page):

<!-- blog/templates/registration/logged_out.html -->
{% extends "blog/base.html" %}

{% block title %}Logged Out{% endblock %}

{% block content %}
<h2>You have been logged out.</h2>
<p><a href="{% url 'login' %}">Log in again</a></p>
{% endblock %}
            

4. Protecting Views with `@login_required`

To ensure a user must be logged in to access a view, use the `@login_required` decorator.

# blog/views.py (updated)
from django.shortcuts import render
from django.contrib.auth.decorators import login_required # Import the decorator
from django.contrib.auth.models import User # Or from .models import UserProfile if you need custom data

@login_required # This decorator redirects unauthenticated users to LOGIN_URL
def user_profile_view(request):
    # 'request.user' is automatically available and refers to the currently logged-in User instance
    # You can access related UserProfile data:
    try:
        user_profile = request.user.userprofile
    except UserProfile.DoesNotExist:
        user_profile = None # Handle case where user might not have a profile yet
    
    context = {
        'user': request.user,
        'user_profile': user_profile,
    }
    return render(request, 'blog/profile.html', context)
            

Now, create `blog/templates/blog/profile.html` to display this information.

Key Takeaways & Best Practices

• Always use Django's built-in authentication and authorization system; don't try to build your own. It's secure and robust.
• Understand the difference between Authentication ("Who are you?") and Authorization ("What can you do?").
• Extend Django's `User` model with a `UserProfile` model (OneToOneField) for adding custom user data.
• Include `django.contrib.auth.urls` for easy access to login/logout/password management views.
• Use LOGIN_REDIRECT_URL and LOGOUT_REDIRECT_URL in settings.py to control redirects.
• Protect views requiring a login with the `@login_required` decorator.
• Control access to views based on permissions using the `@permission_required` decorator.
• Use {% if user.is_authenticated %} and {% if perms.app_label.permission_codename %} in templates for dynamic content display.
• Security Note: Django handles password hashing automatically, which is a significant security feature.