Django Authentication and Authorization: User Registration, Login, Logout, Password Management, and Access Control

Introduction

Django Authentication is a built-in system that allows users to register, log in, log out, and manage their accounts. Django provides authentication tools for verifying user identities and controlling access to application features.

Authorization determines what an authenticated user is permitted to do. For example, an administrator may manage all student records, while a regular user may only view or update their own information.

In this module, you will learn how to implement user registration, login, logout, password management, authentication decorators, permissions, groups, and role-based access control in a Django application.

What You Will Learn

1. Understanding authentication and authorization.

2. Understanding Django's built-in User model.

3. Creating a user registration system.

4. Implementing login and logout functionality.

5. Using Django's authentication views.

6. Protecting pages with the login_required decorator.

7. Understanding password hashing and password validation.

8. Implementing password change and password reset.

9. Managing users through Django Admin.

10. Understanding groups and permissions.

11. Implementing role-based access control.

12. Displaying user-specific information in templates.

13. Protecting views against unauthorized access.

14. Following authentication security best practices.

1. Understanding Authentication and Authorization

Authentication answers the question: “Who are you?”

Authorization answers the question: “What are you allowed to do?”

For example, consider a Student Management System.

• Administrator: Can manage students and application settings.

• Staff Member: Can access authorized student-management features.

• Student: Can view their own permitted information.

Authentication verifies the user's identity, while authorization checks whether the user has permission to perform a particular action.

Important: Hiding a button in a template does not protect the corresponding operation. Permissions must also be checked on the server.

2. Understanding Django's Built-in User Model

Django provides a built-in User model through django.contrib.auth.

It includes common account fields and functionality, such as:

• Username.

• Email address.

• Password hash.

• Active status.

• Staff status.

• Superuser status.

• Permission relationships.

Django also provides authentication utilities and session management, reducing the need to implement account security from scratch.

To use the User model in a view:

from django.contrib.auth.models import User

For a new project, consider using a custom user model if your application requires additional account fields or a different login identifier. Decide this before the first migration whenever possible.

3. Configuring Django Authentication

In a standard Django project, check that the following applications are included in settings.py:

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
]

Also ensure that session and authentication middleware are configured:

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

These are examples of the standard configuration. Preserve the existing settings in your project rather than replacing the entire lists blindly.

Apply migrations if you have not already done so:

python manage.py migrate

4. Creating a User Registration Form

Django provides UserCreationForm for creating accounts with password validation.

Create accounts/forms.py:

from django import forms
from django.contrib.auth.forms import UserCreationForm
from django.contrib.auth.models import User


class RegistrationForm(UserCreationForm):

    email = forms.EmailField(required=True)

    class Meta:
        model = User
        fields = [
            'username',
            'email',
            'password1',
            'password2',
        ]

    def save(self, commit=True):
        user = super().save(commit=False)

        user.email = self.cleaned_data['email']

        if commit:
            user.save()

        return user

Explanation:

• UserCreationForm handles password fields and password validation.

• password1 accepts the password.

• password2 confirms the password.

• EmailField validates the basic email format.

• save() creates the user using Django's password-handling mechanisms.

Important: Email format validation does not prove that the email address belongs to the user. Email verification requires an additional workflow.

5. Implementing User Registration

Create accounts/views.py:

from django.shortcuts import render, redirect
from django.contrib import messages
from .forms import RegistrationForm


def register(request):

    if request.method == 'POST':
        form = RegistrationForm(request.POST)

        if form.is_valid():
            form.save()

            messages.success(
                request,
                'Your account has been created successfully.'
            )

            return redirect('login')

    else:
        form = RegistrationForm()

    return render(
        request,
        'accounts/register.html',
        {'form': form}
    )

How the registration process works:

1. The user opens the registration page.

2. Django displays the registration form.

3. The user submits their username, email, and password.

4. Django validates the submitted information.

5. The password is stored using Django's password-hashing system, not as plain text.

6. A successful registration redirects the user to the login page.

6. Creating the Registration Template

Create templates/accounts/register.html:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>User Registration</title>
</head>
<body>

    <h2>Create an Account</h2>

    <form method="post">
        {% csrf_token %}

        {{ form.as_p }}

        <button type="submit">Register</button>
    </form>

    <p>
        Already have an account?
        <a href="{% url 'login' %}">Login here</a>
    </p>

</body>
</html>

The {% csrf_token %} tag supports Django's CSRF protection for the POST form.

7. Implementing User Login

Django provides LoginView for authentication.

Create a login template at templates/registration/login.html:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>User Login</title>
</head>
<body>

    <h2>Login</h2>

    {% if form.errors %}
        <p>Invalid username or password. Please try again.</p>
    {% endif %}

    <form method="post">
        {% csrf_token %}

        {{ form.as_p }}

        <button type="submit">Login</button>
    </form>

    <p>
        <a href="{% url 'password_reset' %}">
            Forgot password?
        </a>
    </p>

</body>
</html>

Configure the authentication URLs in your project's urls.py:

from django.contrib import admin
from django.urls import path, include
from accounts import views as account_views

urlpatterns = [
    path('admin/', admin.site.urls),
    path('accounts/register/', account_views.register, name='register'),
    path('accounts/', include('django.contrib.auth.urls')),
]

The built-in authentication URL configuration provides routes for login, logout, password change, and password reset.

Set the post-login and post-logout destinations in settings.py:

LOGIN_REDIRECT_URL = '/'
LOGOUT_REDIRECT_URL = '/accounts/login/'

The login route will be available at:

http://127.0.0.1:8000/accounts/login/

Important: Ensure that the templates and URL names match your project configuration.

8. Implementing Logout

Django's built-in LogoutView handles logout through a POST request in current Django versions.

Use a POST form for the logout action:

<form method="post" action="{% url 'logout' %}">
    {% csrf_token %}

    <button type="submit">Logout</button>
</form>

When the user submits this form, Django logs out the current user and redirects them according to the configured logout destination.

Security note: Avoid implementing logout through an ordinary GET link when using Django's standard LogoutView, because logout changes the user's authentication state.

9. Protecting Pages with login_required

Some pages should only be accessible to authenticated users.

Use Django's login_required decorator:

from django.contrib.auth.decorators import login_required
from django.shortcuts import render


@login_required
def dashboard(request):

    return render(
        request,
        'accounts/dashboard.html'
    )

If an unauthenticated visitor opens the dashboard, Django redirects them to the configured login page.

You can configure the login URL in settings.py:

LOGIN_URL = '/accounts/login/'

This is useful for dashboards, account settings, private reports, and user profile pages.

10. Displaying the Logged-in User

Django makes the current user available as request.user in views when authentication middleware is configured.

For example:

from django.contrib.auth.decorators import login_required
from django.shortcuts import render


@login_required
def profile(request):

    context = {
        'user': request.user,
    }

    return render(
        request,
        'accounts/profile.html',
        context
    )

In the template:

<h2>My Profile</h2>

<p>Username: {{ user.username }}</p>
<p>Email: {{ user.email }}</p>

You can also display the username directly through the request context:

{% if request.user.is_authenticated %}
    <p>Welcome, {{ request.user.username }}!</p>
{% endif %}

This makes it easy to personalize navigation bars and dashboards.

11. Understanding Password Hashing

Django does not store passwords as ordinary readable text. It uses configured password hashers to store password hashes.

When a user logs in, Django checks the supplied password against the stored hash.

Avoid manually assigning a plain-text password:

# Incorrect approach
user.password = 'mypassword123'

Instead, use:

user.set_password('mypassword123')
user.save()

For registration, prefer UserCreationForm or another properly implemented Django authentication form.

Important: Password hashing protects stored password representations, but it does not replace HTTPS, secure session handling, or other account-security measures.

12. Password Change and Password Reset

Django provides built-in views for password management through:

path('accounts/', include('django.contrib.auth.urls')),

Common authentication routes include:

• password_change/ — allows authenticated users to change their passwords.

• password_change/done/ — confirms a completed password change.

• password_reset/ — begins the password reset process.

• password_reset/done/ — confirms the reset request.

• reset/<uidb64>/<token>/ — validates a reset link.

• reset/done/ — confirms the completed reset.

The corresponding templates are commonly placed inside templates/registration/.

For password reset by email, configure Django's email backend correctly. During development, Django's console email backend can help display reset messages without sending real emails.

Security note: Password reset workflows should avoid revealing whether a particular email address is registered. Use appropriate token expiration and secure email delivery.

13. Understanding Groups and Permissions

Django includes a permissions system for controlling access to specific operations.

By default, Django creates standard model permissions during migration, including:

• add — permission to add an object.

• change — permission to modify an object.

• delete — permission to delete an object.

• view — permission to view objects.

Groups allow administrators to assign a collection of permissions to multiple users.

For example:

• Administrators: Manage authorized application settings and records.

• Staff: Perform assigned administrative tasks.

• Students: Access their own permitted features.

You can check a permission in a view:

from django.contrib.auth.decorators import permission_required
from django.shortcuts import render


@permission_required('students.view_student', raise_exception=True)
def student_report(request):

    return render(
        request,
        'students/report.html'
    )

Replace students.view_student with the actual application label and permission codename used by your project.

Important: Model permissions do not automatically implement object-level access rules. If students should only see their own records, filter the records by the authenticated user or use a suitable object-permission system.

14. Implementing Role-Based Access Control

Role-based access control assigns permissions according to a user's responsibilities.

Django's built-in groups provide a straightforward way to organize roles.

For example, you can create groups such as Admin, Staff, and Student through Django Admin.

To check group membership:

from django.contrib.auth.decorators import login_required
from django.core.exceptions import PermissionDenied
from django.shortcuts import render


@login_required
def staff_dashboard(request):

    if not request.user.groups.filter(
        name='Staff'
    ).exists():
        raise PermissionDenied

    return render(
        request,
        'accounts/staff_dashboard.html'
    )

This example allows authenticated members of the Staff group to access the view.

For production applications, assign group membership through authorized administrative workflows and combine role checks with the permissions required for each operation.

Important: Do not allow users to choose privileged roles for themselves during public registration.

15. Understanding is_staff and is_superuser

Django provides two important account flags.

is_staff determines whether a user is permitted to access the Django Admin site, subject to the relevant admin permissions.

is_superuser grants all permissions without requiring individual permission assignments.

Example:

if request.user.is_superuser:
    print("Superuser account")

These flags are not interchangeable with custom business roles.

For example, a hospital receptionist or a school staff member may need access to selected application functions without being a superuser.

Use groups, model permissions, and appropriate authorization checks to implement such restrictions.

16. Common Authentication Mistakes

1. Storing passwords as plain text.

2. Forgetting CSRF tokens in POST forms.

3. Allowing unauthenticated users to access protected views.

4. Relying only on hidden buttons to enforce permissions.

5. Allowing users to assign themselves privileged roles.

6. Forgetting to configure login and logout redirects.

7. Using insecure GET requests for state-changing actions.

8. Exposing sensitive account information in error messages.

9. Forgetting to configure email delivery for password resets.

10. Assuming that is_staff automatically grants every application permission.

11. Forgetting to protect user-specific records from access by other users.

12. Disabling security middleware or authentication checks to fix unrelated errors.

Frequently Asked Questions (FAQs)

Q1. What is Django Authentication?

Django Authentication verifies user identities and provides login, logout, password management, and session-related functionality.

Q2. What is Authorization?

Authorization determines which actions or resources an authenticated user is permitted to access.

Q3. What is UserCreationForm?

It is a Django form that creates users while applying password validation and proper password handling.

Q4. What does login_required do?

It restricts access to a view to authenticated users and redirects unauthenticated visitors to the login page.

Q5. What is the difference between is_staff and is_superuser?

is_staff controls eligibility for Django Admin access, subject to admin permissions. is_superuser grants all permissions.

Q6. What are Django Groups?

Groups allow administrators to assign the same set of permissions to multiple users.

Q7. Does Django store plain-text passwords?

No. Django uses password hashers to store password hashes.

Q8. Can Django support multiple user roles?

Yes. Groups, permissions, and custom authorization logic can be used to implement role-based access control.

Interview Questions and Answers

Q1. What is the purpose of authenticate()?

It verifies supplied credentials and returns a user object when authentication succeeds, or None when it fails.

Q2. What does login() do?

It associates an authenticated user with the current session.

Q3. What does logout() do?

It logs out the current user and clears the authentication session data.

Q4. What is the purpose of request.user?

It provides the current user object or an anonymous user when the visitor is not authenticated.

Q5. What is the difference between authentication and authorization?

Authentication verifies identity, while authorization determines permitted actions.

Q6. Why should privileged roles not be assigned through public registration forms?

Unrestricted role assignment could allow users to gain administrative access without authorization.

Q7. How can a Django view require a specific permission?

Use permission_required, user_passes_test, or an equivalent authorization check appropriate to the application.

Practical Assignment

Build a User Authentication and Authorization System using Django.

Requirements:

1. Create a user registration page.

2. Validate usernames, emails, and passwords.

3. Implement login and logout.

4. Create a protected dashboard.

5. Display the authenticated user's information.

6. Add a password change workflow.

7. Configure password reset templates and email delivery.

8. Create Admin, Staff, and Student groups.

9. Assign permissions to appropriate groups.

10. Protect administrative views from unauthorized users.

11. Restrict students to their own permitted information.

12. Test anonymous access, incorrect passwords, and unauthorized actions.

Expected Outcome: You should be able to build a secure Django authentication system with registration, login, logout, password management, groups, and permissions.

Conclusion

Django Authentication and Authorization provide the foundation for secure user accounts and controlled access to application features. By understanding the User model, authentication views, password hashing, groups, permissions, and protected views, developers can build applications that support different user responsibilities.

These concepts are essential for student management systems, hospital portals, e-commerce websites, employee dashboards, and other applications that require secure access control.

In the next module, you will learn about Django Class-Based Views (CBVs), including TemplateView, ListView, DetailView, CreateView, UpdateView, and DeleteView.