Django · Lesson 6 of 15

Users, Login and Permissions

Use Django's auth system: login, logout, the User model and object permissions.

Intermediate
16 min read
3 objectives

Before this lessonLesson 5: Building a JSON API

What you will learn

Log a user in
Protect a view
Check permissions

Your Progress

0 of 15 lessons 0%

Lessons0 / 15
Completed0
Est. time left~ 4 hours

Create a free account to keep your progress on every device.

Django ships a complete auth system: a User model, password hashing, login views, groups and permissions. Use it instead of rolling your own.

The User model

from django.contrib.auth.models import User

user = User.objects.create_user(username="ada", email="ada@example.com", password="s3cret-long")
user.check_password("s3cret-long")     # True
user.is_staff                          # False unless you set it

Never set user.password = "..." directly. Always create_user / set_password so the value is hashed.

Login, logout, and login_required

# urls.py
from django.contrib.auth import views as auth_views
urlpatterns = [
    path("login/", auth_views.LoginView.as_view(template_name="login.html"), name="login"),
    path("logout/", auth_views.LogoutView.as_view(), name="logout"),
]

# views.py
from django.contrib.auth.decorators import login_required

@login_required
def dashboard(request):
    return render(request, "dashboard.html", {"user": request.user})

Permissions

from django.contrib.auth.decorators import permission_required
from django.contrib.auth.mixins import UserPassesTestMixin

@permission_required("blog.delete_post")
def delete_post(request, pk):
    ...

class EditorRequired(UserPassesTestMixin):
    def test_func(self):
        return self.request.user.groups.filter(name="editors").exists()

# Write your solution here

Up next · Lesson 7Class-Based ViewsListView, DetailView, CreateView and mixins instead of long function views.