Authentication & Users

Logging a user in is explicitly divided into two functions. First, authenticate(username, password) queries the database, applies the PBKDF2 hashing algorithm to the provided password, and checks if it mathematically matches the stored hash. Second, login(request, user) takes the verified user and attaches a Session ID to their browser cookies, officially marking them as logged in.

By default, any URL you define can be visited by anyone in the world. To secure a Function-Based View, you add the @login_required decorator above it. If an anonymous user visits the URL, Django intercepts them and redirects them to the login page. For Class-Based Views, you inherit LoginRequiredMixin as the absolute first argument in your class definition.

Because Django knows checking is_authenticated is necessary on almost every HTML page (for headers and navbars), it uses a 'Context Processor'. This is a background script that automatically injects the user object into every single template's context dictionary. You never have to explicitly pass it from your View; it is simply always available as {{ user }}.

Django Authentication. Building a secure login system from scratch is extremely difficult and dangerous. Django provides a battle-tested Authentication System out of the box. It handles user accounts, password hashing, session cookies, and login tracking. At its core is the built-in User model, which provides essential fields like username, email, and password.

Password Hashing. You must NEVER save passwords as plain text. If your database is breached, hackers will instantly steal every user's password. When you use create_user() or set_password(), Django automatically runs the password through the highly secure PBKDF2 hashing algorithm. Even as the database administrator, you cannot see the user's real password; you only see a long string of cryptographic gibberish.

If you want to manually update a user's password using the Python shell, which method MUST you use to ensure the password is mathematically hashed instead of being saved as plain text?

• →user.set_password('new_pass')
• →user.password = 'new_pass'

Authenticate and Login. The login process requires two distinct steps. First, authenticate() checks if the provided username and password match the hashed database record. If they do, it returns the User object (otherwise it returns None). Second, login() actually creates the browser Session. It generates a secure Session Cookie and sends it to the user's browser, officially keeping them 'logged in' across page refreshes.

The @login_required Decorator. Once a user is logged in, you need to protect specific pages (like the Dashboard or Settings) from anonymous visitors. The @login_required decorator sits on top of your Function-Based View. If an anonymous user tries to access the URL, the decorator intercepts the request and instantly redirects them to the login page before the view code even executes.

Using LoginRequiredMixin (CBVs). If you are using Class-Based Views (CBVs), you cannot use a standard function decorator. Instead, Django provides the LoginRequiredMixin. In Python, a Mixin is a small class designed to be inherited alongside your main class. By injecting LoginRequiredMixin as the absolute first inherited class, you instantly secure the entire CBV.

In Python Class-Based inheritance, why MUST the LoginRequiredMixin be placed first in the list, before the main view class (e.g., TemplateView)?

• →Because Python's Method Resolution Order (MRO) reads left-to-right. The mixin must intercept the request before the view processes it.
• →Because classes must be imported alphabetically.

Accessing the User in Templates. Django's auth system automatically injects the user object into every single HTML template's context via the Context Processors. You do not need to manually pass it from the View. In your HTML, you can simply write {{ user.username }}. Furthermore, you can use {% if user.is_authenticated %} to dynamically show a 'Logout' button to logged-in users, and a 'Login' button to anonymous visitors.

Authentication Mastered. Outstanding! You have successfully mastered Django Authentication. You understand how the built-in User model securely hashes passwords, the two-step authenticate() and login() process, how to protect FBVs and CBVs using decorators and mixins, and how to dynamically render UI based on the user's state. Next, we will upgrade from Authentication (who are you?) to Authorization (what are you allowed to do?).