Authentication and authorization are fundamental pillars of web application security. They ensure that only legitimate users can access your application and that they have the appropriate permissions to perform specific actions. Django, with its robust built-in system, makes managing these crucial aspects a breeze. This blog post will guide you through Django's authentication and authorization framework, including a detailed walkthrough of implementing a custom user model.

Understanding Authentication and Authorization:

• Authentication: Verifies who a user is. It involves confirming the user's identity, typically through credentials like a username and password.
• Authorization: Determines what a user is allowed to do. It controls access to specific resources or functionalities based on the user's roles or permissions.

Django's Authentication System:

Django provides a comprehensive authentication system that handles user registration, login, logout, and password management. It uses a pluggable backend system, allowing you to customize how users are authenticated.

Key Components:

• User Model: Represents a user in your application. Django provides a default User model, but you can create a custom one if you need to store additional information.
• Authentication Backends: Define how users are authenticated. Django's default backend handles username/password authentication.
• Forms: Django provides forms for user registration, login, and password reset.
• Views: Views handle the logic for authentication-related actions.
• Templates: Templates render the user interface for login, registration, etc.

Django's Authorization System:

Django's authorization system is built on top of its authentication system. It uses permissions and roles to control access to resources.

Key Components:

• Permissions: Specific rights that can be granted to users or groups.
• Groups: Collections of users with similar permissions.
• @login_required decorator: Restricts access to a view to authenticated users only.
• @permission_required decorator: Restricts access to a view to users with a specific permission.
• has_perm() method: Checks if a user has a specific permission.

Implementing a Custom User Model:

While Django's default User model works for many cases, you might need to extend it to store additional user-related information (e.g., profile picture, date of birth). Here's how to create a custom user model:

1. Create a Model: Create a new model in your models.py file that inherits from AbstractUser (for full customization) or AbstractBaseUser (if you want more control over the authentication process).

   Python

    

   from django.contrib.auth.models import AbstractUser
   from django.db import models
   
   class CustomUser(AbstractUser):
       # Add your custom fields here
       date_of_birth = models.DateField(null=True, blank=True)
       profile_picture = models.ImageField(upload_to='profile_pics/', blank=True)
   
       # You can remove the username field if you want to use email as username
       # username = None  # Remove default username
       # email = models.EmailField(_('email address'), unique=True) # Make email unique
   
       USERNAME_FIELD = 'email' # Set email as username
       REQUIRED_FIELDS = [] # List of fields that are required during user creation (leave empty if you want all fields optional)
   
       def __str__(self):
           return self.email # or self.username
   
   

2. Update AUTH_USER_MODEL: In your settings.py file, tell Django to use your custom user model:

   Python

    

   AUTH_USER_MODEL = 'your_app_name.CustomUser'
   

3. Run Migrations: Create and apply migrations to update your database schema:

   Bash

    

   python manage.py makemigrations
   python manage.py migrate
   

4. Update Forms: If you're using Django's built-in forms for user creation or editing, you'll need to update them to use your custom user model. You can create custom forms that inherit from UserCreationForm or UserChangeForm and override the Meta class to specify your custom user model.

   Python

    

   from django.contrib.auth.forms import UserCreationForm, UserChangeForm
   from .models import CustomUser
   
   class CustomUserCreationForm(UserCreationForm):
       class Meta:
           model = CustomUser
           fields = ('email', 'date_of_birth', 'profile_picture') # Add your custom fields
   
   class CustomUserChangeForm(UserChangeForm):
       class Meta:
           model = CustomUser
           fields = ('email', 'date_of_birth', 'profile_picture') # Add your custom fields
   
   

5. Admin Site: Update the Django admin to use your custom user model. Create a custom UserAdmin class and register it with your model.

   Python

    

   from django.contrib import admin
   from django.contrib.auth.admin import UserAdmin
   from .models import CustomUser
   from .forms import CustomUserCreationForm, CustomUserChangeForm
   
   
   @admin.register(CustomUser)
   class CustomUserAdmin(UserAdmin):
       add_form = CustomUserCreationForm
       form = CustomUserChangeForm
       model = CustomUser
       list_display = ['email', 'date_of_birth'] # Add your custom fields to the list display
       fieldsets = (
           (None, {'fields': ('email', 'password')}),
           ('Personal info', {'fields': ('first_name', 'last_name', 'date_of_birth', 'profile_picture')}), # Add your custom fields to the fieldsets
           ('Permissions', {'fields': ('is_active', 'is_staff', 'is_superuser', 'groups', 'user_permissions')}),
           ('Important dates', {'fields': ('last_login', 'date_joined')}),
       )
   
   

Example: Protecting a View with @login_required:

from django.contrib.auth.decorators import login_required
from django.shortcuts import render

@login_required
def my_protected_view(request):
    # This view is only accessible to authenticated users
    return render(request, 'my_template.html')

Conclusion:

Django's authentication and authorization system provides a solid foundation for securing your web applications. By understanding its components and leveraging its flexibility, including the ability to create custom user models, you can effectively manage user access and protect your valuable resources. Remember to always follow security best practices and thoroughly test your authentication and authorization implementation.