🔐 Day 7: Django Authentication – Beginner’s Web Dev Series

Welcome to Day 7 of the Django for Beginners journey!
Today, we dive deep into user authentication in Django — the core of most web applications involving users.

We'll learn:

• How login/logout works

• How to create a user registration system

• How to protect views

• And, importantly, how to create a custom login system from scratch to understand the flow

---

📍 What You’ll Learn

1. How Django's built-in auth system works

2. Handling login, logout, and user registration

3. Checking if a user is authenticated

4. Protecting views with decorators

5. Creating a custom login system manually

---

1. Django’s Built-in Auth System

Django provides:

• User model

• Login/logout views

• Password hashing

• CSRF protection

• Secure session handling

---

2. Login and Logout (Built-in)

Add to urls.py

from django.contrib.auth import views as auth_views

urlpatterns = [
    path('login/', auth_views.LoginView.as_view(template_name='login.html'), name='login'),
    path('logout/', auth_views.LogoutView.as_view(next_page='login'), name='logout'),
]

Create login.html

<form method="POST">
  {% csrf_token %}
  {{ form.as_p }}
  <button type="submit">Login</button>
</form>

---

3. User Registration with UserCreationForm

View:

from django.contrib.auth.forms import UserCreationForm

def register(request):
    form = UserCreationForm(request.POST or None)
    if form.is_valid():
        form.save()
        return redirect('login')
    return render(request, 'register.html', {'form': form})

Template:

<form method="POST">
  {% csrf_token %}
  {{ form.as_p }}
  <button type="submit">Register</button>
</form>

---

4. Checking if a User is Logged In

In Python:

if request.user.is_authenticated:
    print("Welcome", request.user.username)

In Templates:

{% if user.is_authenticated %}
  Hi, {{ user.username }}
{% else %}
  Not logged in
{% endif %}

---

5. Protecting Views

Option 1: Manually

def dashboard(request):
    if not request.user.is_authenticated:
        return redirect('login')
    return render(request, 'dashboard.html')

Option 2: Use Decorator

from django.contrib.auth.decorators import login_required

@login_required(login_url='login')
def dashboard(request):
    return render(request, 'dashboard.html')

---

6. Custom Login – Understand How It Works Internally

Here’s how Django authentication works step by step using manual logic.

Create a Custom Login Form

# forms.py

from django import forms

class CustomLoginForm(forms.Form):
    username = forms.CharField()
    password = forms.CharField(widget=forms.PasswordInput)

---

View: Custom Login Logic

# views.py

from django.contrib import messages
from django.contrib.auth import authenticate, login
from django.shortcuts import render, redirect
from .forms import CustomLoginForm

def custom_login(request):
    form = CustomLoginForm(request.POST or None)
    if request.method == 'POST' and form.is_valid():
        username = form.cleaned_data['username']
        password = form.cleaned_data['password']

        user = authenticate(request, username=username, password=password)
        if user is not None:
            login(request, user)
            return redirect('dashboard')
        else:
            messages.error(request, "Invalid credentials")

    return render(request, 'custom_login.html', {'form': form})

---

Template: custom_login.html

<h2>Custom Login</h2>
{% if messages %}
<ul class="messages">
    {% for message in messages %}
    <li{% if message.tags %} class="{{ message.tags }}"{% endif %}>{{ message }}</li>
    {% endfor %}
</ul>
{% endif %}

<form method="POST">
  {% csrf_token %}
  {{ form.as_p }}
  <button type="submit">Login</button>
</form>

---

Logout View (Manual)

from django.contrib.auth import logout

def custom_logout(request):
    logout(request)
    return redirect('custom_login')

---

URLs

urlpatterns = [
    path('login/', custom_login, name='custom_login'),
    path('logout/', custom_logout, name='custom_logout'),
]

---

Recap: How Login Actually Works

---

✅ Task for Day 7

• Create your own register, login, and logout views and templates.

• Use authenticate() and login() in a custom view.

• Protect one page (like /dashboard/) with @login_required.

• Bonus: Show login error on invalid input.

---

🚀 Coming Up in Day 8…

We’ll explore:

• Setup git and github

• Setup Environment Variables

• Prepare for production environment