Client-Side vs. Server-Side Storage Evolution

Early web architecture were stateless, serving identical content to all visitors. As e-commerce and social platforms emerged, user state became critical. Initial solutions utilized cookies, storing key-value pairs locally on the client browser. While simple, cookies are vulnerable to interception and tampering since data resides outside server control.

To address security concerns, server-side sessions were introduced. The server generates a unique identifier, encrypts sensitive data, and sends only the token to the client. The actual data remains securely stored on the server. Modern implementations often incorporate tokens (such as JWT) utilizing three-part encryption standards for distributed state management.

Implementing Cookie-Based Authentication

Cookies are managed via HTTP responses. They persist across browser restarts unless configured otherwise.

Configuring Response Headers

from django.http import HttpResponse, HttpResponseRedirect

def authenticate_cookie(request):
    if request.method == 'POST':
        username = request.POST.get('username')
        password = request.POST.get('password')
        
        if username == 'admin' and password == 'secret_pass':
            response = HttpResponse('Login Successful')
            response.set_cookie('auth_status', 'active', max_age=3600)
            return response
        
        return HttpResponseRedirect('/login/')
    return render(request, 'login_form.html')

Retrieving and Validating Data

Client requests automatically include cookie headers accessible via request.COOKIES.

def protected_resource(request):
    status = request.COOKIES.get('auth_status')
    
    if status == 'active':
        return HttpResponse('Welcome to the dashboard')
    
    return HttpResponseRedirect(f'/login/?next={request.path}')

Lifecycle Management

Control expiration and removal explicitly. Setting expires or max_age defines duration.

response.set_cookie('key', 'value', max_age=300)  # Seconds
response.delete_cookie('key')

A custom decorator can handle redirection logic for unauthorized access attempts while preserving the intended destination URL.

def login_required(func):
    def wrapper(request, *args, **kwargs):
        next_url = request.get_full_path()
        if not request.COOKIES.get('auth_status'):
            return HttpResponseRedirect(f'/login/?next={next_url}')
        return func(request, *args, **kwargs)
    return wrapper

@login_required
def secure_page(request):
    return HttpResponse('Restricted Content')

Server-Side Session Architecture

Unlike cookies, Django sessions store data on the server side, typically linked to a database table named django_session. This prevents client-side manipulation of credentials.

Initialization and Access

The session object acts as a dictionary-like interface bound to a unique session ID tracked by the browser.

def save_user_data(request):
    if request.method == 'POST':
        # Simulate validation
        if request.POST.get('password') == 'valid':
            request.session['user_id'] = 12345
            request.session['role'] = 'editor'
            return HttpResponseRedirect('/dashboard/')
        return HttpResponseRedirect('/login/')
    return render(request, 'login.html')

Configuration and Cleanup

Session lifespan can be adjusted globally or per instance using set_expiry.

request.session['temp_data'] = 'value'
request.session.set_expiry(3600)  # 1 hour
request.session.set_expiry(0)     # Expires on browser close

# Full cleanup for logout
request.session.flush() 

Important Notes on Sessions:

• Requires migration to create the underlying database table.
• One session ID per browser instance per IP range (depending on configuration).
• Stale data is cleaned up periodically; expired entries do not persist indefinitely.

Securing Class-Based Views (CBV)

When using generic views, authentication logic can be applied in three primary ways:

1. Method-Level Decoration

Apply decorators directly to specific HTTP method handlers.

from django.utils.decorators import method_decorator

@method_decorator(login_required, name='get')
class MyProtectedView(View):
    def get(self, request):
        return HttpResponse('Secure GET')

2. Dispatch Override

Intercept all requests before they reach specifci methods.

@method_decorator(login_required, name='dispatch')
class AllProtectedView(View):
    def get(self, request): ...
    def post(self, request): ...

3. Global Application

Use @method_decorator on the dispatch method explicitly within the class definition to enforce rules across all actions defined in that view.

This ensures consistent authorization handling regardless of request verb.