Django auth Module Key Concepts

1. Creating a superuser:

   python manage.py createsuperuser
   

   Import the auth module:

   from django.contrib import auth
   

2. auth.authenticate(username=username, password=pwd)

   • Validates the username and password.
   • Returns a user object on success, else None (anonymous user).

3. auth.login(request, user)

   • Assigns the authenticated user to the request.user attribute.

4. auth.logout(request)

   • Equivalent to request.session.flush() – removes all session data and invalidates the cookie.

Example Code

from django.contrib import auth
from django.contrib.auth.decorators import login_required

def login(request):
    if request.method == "POST":
        username = request.POST.get("username")
        pwd = request.POST.get("password")
        # Determine if the username and password are correct
        user = auth.authenticate(username=username, password=pwd)
        if user:
            ret = user.is_authenticated()
            print(ret)
            print("-" * 120)

            # Encapsulate the logged-in user into request.user
            auth.login(request, user)
            return redirect("/index/")
    return render(request, "login.html")


@login_required
def index(request):
    print(request.user.username)
    print("=" * 120)
    ret = request.user.is_authenticated()
    print(ret)
    return render(request, "index.html")


def logout(request):
    auth.logout(request)
    return redirect("/login/")

Permission Control Based on Middleware

# by luffycity.com
import re
from django.utils.deprecation import MiddlewareMixin
from django.shortcuts import HttpResponse, redirect


class ValidPermission(MiddlewareMixin):

    def process_request(self, request):
        # Current access path
        current_path = request.path_info

        # Check against whitelist
        valid_url_list = ["/login/", "/reg/", "/admin/.*"]
        for valid_url in valid_url_list:
            ret = re.match(valid_url, current_path)
            if ret:
                return None

        # Check if user is logged in
        user_id = request.session.get("user_id")
        if not user_id:
            return redirect("/login/")

        # Check permissions
        permission_list = request.session.get("permission_list", [])
        # Example: ['/users/', '/users/add', '/users/delete/(\d+)', 'users/edit/(\d+)']

        flag = False
        for permission in permission_list:
            permission = "^%s$" % permission

            ret = re.match(permission, current_path)
            if ret:
                flag = True
                break
        if not flag:
            return HttpResponse("No access permission!")

        return None

OSI Seven-Layer Model

The internet protocols are conceptually divided in to layers based on different functions:

• Application Layer, Session Layer, Presentation Layer, Transport Layer, Network Layer, Data Link Layer, Physical Layer.

Or a simplified view:

• Application Layer, Transport Layer, Network Layer, Data Link Layer, Physical Layer.