Bài 14: Authentication Basics

Django Authentication System

Django Authentication là built-in system để quản lý users, permissions và authentication.

# Django provides:# 1. User model (django.contrib.auth.models.User)# 2. Login/Logout views# 3. Password management (change, reset)# 4. Permissions and groups# 5. Authentication middleware# 6. Decorators (@login_required, @permission_required) # settings.py - Already included by defaultINSTALLED_APPS = [    'django.contrib.auth',          # Authentication framework    'django.contrib.contenttypes',  # Required for permissions    # ...] MIDDLEWARE = [    'django.contrib.sessions.middleware.SessionMiddleware',    'django.contrib.auth.middleware.AuthenticationMiddleware',    # ...] # Authentication is ready to use!

User Model

from django.contrib.auth.models import User # User model fields:# - username (CharField, unique, required)# - first_name (CharField, optional)# - last_name (CharField, optional)# - email (EmailField, optional)# - password (CharField, hashed)# - is_staff (Boolean, admin access)# - is_active (Boolean, account active)# - is_superuser (Boolean, all permissions)# - date_joined (DateTimeField)# - last_login (DateTimeField) # Create useruser = User.objects.create_user(    username='john',    email='john@example.com',    password='securepassword123'  # Automatically hashed) # Create superusersuperuser = User.objects.create_superuser(    username='admin',    email='admin@example.com',    password='adminpass123') # Check passworduser.check_password('securepassword123')  # Trueuser.check_password('wrongpassword')      # False # Change passworduser.set_password('newpassword456')user.save()

# urls.pyfrom django.contrib.auth import views as auth_viewsfrom django.urls import path urlpatterns = [    # Built-in login view    path('login/', auth_views.LoginView.as_view(), name='login'),        # With custom template    path('login/', auth_views.LoginView.as_view(        template_name='accounts/login.html'    ), name='login'),        # Logout    path('logout/', auth_views.LogoutView.as_view(), name='logout'),] # settings.pyLOGIN_REDIRECT_URL = '/'           # Where to redirect after loginLOGOUT_REDIRECT_URL = '/login/'    # Where to redirect after logoutLOGIN_URL = '/login/'              # Login page URL

<!-- templates/registration/login.html --><!DOCTYPE html><html><head>    <title>Login</title></head><body>    <h2>Login</h2>        {% if form.errors %}        <p class="error">Invalid username or password.</p>    {% endif %}        {% if next %}        {% if user.is_authenticated %}            <p>You don't have permission to access this page.</p>        {% endif %}    {% endif %}        <form method="post" action="{% url 'login' %}">        {% csrf_token %}                <div>            <label>Username:</label>            {{ form.username }}        </div>                <div>            <label>Password:</label>            {{ form.password }}        </div>                <button type="submit">Login</button>                <input type="hidden" name="next" value="{{ next }}">    </form>        <p>        Don't have an account? <a href="{% url 'register' %}">Register</a>    </p></body></html>

# views.pyfrom django.contrib.auth import authenticate, login, logoutfrom django.shortcuts import render, redirectfrom django.contrib import messages def login_view(request):    if request.method == 'POST':        username = request.POST.get('username')        password = request.POST.get('password')                # Authenticate user        user = authenticate(request, username=username, password=password)                if user is not None:            # Login successful            login(request, user)                        # Redirect to 'next' parameter or default            next_url = request.GET.get('next', '/')            return redirect(next_url)        else:            # Invalid credentials            messages.error(request, 'Invalid username or password')        return render(request, 'accounts/login.html') def logout_view(request):    logout(request)    messages.success(request, 'You have been logged out')    return redirect('login') # With formfrom django.contrib.auth.forms import AuthenticationForm def login_view(request):    if request.method == 'POST':        form = AuthenticationForm(request, data=request.POST)        if form.is_valid():            user = form.get_user()            login(request, user)                        next_url = request.GET.get('next', '/')            return redirect(next_url)    else:        form = AuthenticationForm()        return render(request, 'accounts/login.html', {'form': form})

Checking Authentication in Templates

<!-- Check if user is logged in -->{% if user.is_authenticated %}    <p>Welcome, {{ user.username }}!</p>    <a href="{% url 'logout' %}">Logout</a>{% else %}    <a href="{% url 'login' %}">Login</a>    <a href="{% url 'register' %}">Register</a>{% endif %} <!-- User information -->{% if user.is_authenticated %}    <div class="user-info">        <p>Username: {{ user.username }}</p>        <p>Email: {{ user.email }}</p>        <p>Full Name: {{ user.get_full_name }}</p>                {% if user.is_staff %}            <p><a href="{% url 'admin:index' %}">Admin Panel</a></p>        {% endif %}    </div>{% endif %}

Basic Usage

from django.contrib.auth.decorators import login_required # Require login for view@login_requireddef profile_view(request):    return render(request, 'profile.html', {        'user': request.user    }) # With custom login URL@login_required(login_url='/accounts/login/')def dashboard_view(request):    return render(request, 'dashboard.html') # With redirect field name@login_required(redirect_field_name='redirect_to')def settings_view(request):    return render(request, 'settings.html') # Usage:# If user not logged in, redirects to:# /accounts/login/?next=/profile/

Class-Based Views

from django.contrib.auth.mixins import LoginRequiredMixinfrom django.views.generic import TemplateView class ProfileView(LoginRequiredMixin, TemplateView):    template_name = 'profile.html'    login_url = '/login/'    redirect_field_name = 'next' # Or use dispatch methodfrom django.views import Viewfrom django.contrib.auth.decorators import login_requiredfrom django.utils.decorators import method_decorator @method_decorator(login_required, name='dispatch')class DashboardView(View):    def get(self, request):        return render(request, 'dashboard.html')

Checking in View

def some_view(request):    # Check if authenticated    if not request.user.is_authenticated:        return redirect('login')        # Check if staff    if not request.user.is_staff:        return HttpResponseForbidden('Staff only')        # Check if superuser    if not request.user.is_superuser:        return HttpResponseForbidden('Admin only')        return render(request, 'template.html')

User Registration

Basic Registration View

# forms.pyfrom django import formsfrom django.contrib.auth.models import Userfrom django.contrib.auth.forms import UserCreationForm class RegisterForm(UserCreationForm):    email = forms.EmailField(required=True)    first_name = forms.CharField(max_length=100, required=True)    last_name = forms.CharField(max_length=100, required=True)        class Meta:        model = User        fields = ['username', 'first_name', 'last_name', 'email',                   'password1', 'password2']        def clean_email(self):        email = self.cleaned_data.get('email')        if User.objects.filter(email=email).exists():            raise forms.ValidationError('Email already registered')        return email # views.pyfrom django.contrib.auth import loginfrom .forms import RegisterForm def register_view(request):    if request.method == 'POST':        form = RegisterForm(request.POST)        if form.is_valid():            # Create user            user = form.save()                        # Auto login after registration            login(request, user)                        messages.success(request, 'Registration successful!')            return redirect('profile')    else:        form = RegisterForm()        return render(request, 'accounts/register.html', {'form': form})

Registration Template

<!-- templates/accounts/register.html --><!DOCTYPE html><html><head>    <title>Register</title></head><body>    <h2>Create Account</h2>        <form method="post">        {% csrf_token %}                {% if form.errors %}            <div class="errors">                <ul>                    {% for field, errors in form.errors.items %}                        {% for error in errors %}                            <li>{{ field }}: {{ error }}</li>                        {% endfor %}                    {% endfor %}                </ul>            </div>        {% endif %}                <div>            <label>Username:</label>            {{ form.username }}            {% if form.username.help_text %}                <small>{{ form.username.help_text }}</small>            {% endif %}        </div>                <div>            <label>Email:</label>            {{ form.email }}        </div>                <div>            <label>First Name:</label>            {{ form.first_name }}        </div>                <div>            <label>Last Name:</label>            {{ form.last_name }}        </div>                <div>            <label>Password:</label>            {{ form.password1 }}            {% if form.password1.help_text %}                <small>{{ form.password1.help_text }}</small>            {% endif %}        </div>                <div>            <label>Confirm Password:</label>            {{ form.password2 }}        </div>                <button type="submit">Register</button>    </form>        <p>        Already have an account? <a href="{% url 'login' %}">Login</a>    </p></body></html>

Custom User Registration

# Without UserCreationFormdef register_view(request):    if request.method == 'POST':        username = request.POST.get('username')        email = request.POST.get('email')        password1 = request.POST.get('password1')        password2 = request.POST.get('password2')                # Validation        errors = []                if User.objects.filter(username=username).exists():            errors.append('Username already taken')                if User.objects.filter(email=email).exists():            errors.append('Email already registered')                if password1 != password2:            errors.append('Passwords do not match')                if len(password1) < 8:            errors.append('Password must be at least 8 characters')                if errors:            return render(request, 'register.html', {'errors': errors})                # Create user        user = User.objects.create_user(            username=username,            email=email,            password=password1        )                # Login automatically        login(request, user)                return redirect('profile')        return render(request, 'accounts/register.html')

Password Management

Change Password

# urls.pyfrom django.contrib.auth import views as auth_views urlpatterns = [    # Built-in password change    path('password-change/',          auth_views.PasswordChangeView.as_view(             template_name='accounts/password_change.html'         ),          name='password_change'),        path('password-change/done/',          auth_views.PasswordChangeDoneView.as_view(             template_name='accounts/password_change_done.html'         ),          name='password_change_done'),] # Custom viewfrom django.contrib.auth.forms import PasswordChangeForm @login_requireddef change_password(request):    if request.method == 'POST':        form = PasswordChangeForm(request.user, request.POST)        if form.is_valid():            user = form.save()            # Update session to prevent logout            update_session_auth_hash(request, user)            messages.success(request, 'Password changed successfully!')            return redirect('profile')    else:        form = PasswordChangeForm(request.user)        return render(request, 'accounts/change_password.html', {'form': form})

Password Reset

# urls.pyurlpatterns = [    # Password reset flow    path('password-reset/',          auth_views.PasswordResetView.as_view(             template_name='accounts/password_reset.html'         ),          name='password_reset'),        path('password-reset/done/',          auth_views.PasswordResetDoneView.as_view(             template_name='accounts/password_reset_done.html'         ),          name='password_reset_done'),        path('password-reset-confirm/<uidb64>/<token>/',          auth_views.PasswordResetConfirmView.as_view(             template_name='accounts/password_reset_confirm.html'         ),          name='password_reset_confirm'),        path('password-reset-complete/',          auth_views.PasswordResetCompleteView.as_view(             template_name='accounts/password_reset_complete.html'         ),          name='password_reset_complete'),] # settings.py - Email configuration for password resetEMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'EMAIL_HOST = 'smtp.gmail.com'EMAIL_PORT = 587EMAIL_USE_TLS = TrueEMAIL_HOST_USER = 'your-email@gmail.com'EMAIL_HOST_PASSWORD = 'your-app-password'DEFAULT_FROM_EMAIL = 'noreply@example.com'

Permissions and Groups

Checking Permissions

# In views@login_requireddef edit_post(request, post_id):    post = get_object_or_404(Post, pk=post_id)        # Check if user is post author    if request.user != post.author:        return HttpResponseForbidden('You can only edit your own posts')        # Check if user has permission    if not request.user.has_perm('blog.change_post'):        return HttpResponseForbidden('You do not have permission')        # Check if user is staff    if not request.user.is_staff:        return HttpResponseForbidden('Staff only')        # Process edit    return render(request, 'edit_post.html', {'post': post}) # Permission decoratorfrom django.contrib.auth.decorators import permission_required @permission_required('blog.add_post', raise_exception=True)def create_post(request):    return render(request, 'create_post.html') @permission_required(['blog.add_post', 'blog.change_post'])def manage_posts(request):    return render(request, 'manage_posts.html')

Permissions in Templates

{% if user.is_authenticated %}    <!-- Check specific permission -->    {% if perms.blog.add_post %}        <a href="{% url 'create_post' %}">Create Post</a>    {% endif %}        {% if perms.blog.change_post %}        <a href="{% url 'edit_post' post.id %}">Edit</a>    {% endif %}        {% if perms.blog.delete_post %}        <a href="{% url 'delete_post' post.id %}">Delete</a>    {% endif %}        <!-- Check if staff -->    {% if user.is_staff %}        <a href="{% url 'admin:index' %}">Admin</a>    {% endif %}        <!-- Check if user owns the object -->    {% if user == post.author %}        <a href="{% url 'edit_post' post.id %}">Edit Your Post</a>    {% endif %}{% endif %}

Working with Groups

from django.contrib.auth.models import Group, Permission # Create groupeditors = Group.objects.create(name='Editors') # Add permissions to groupadd_post = Permission.objects.get(codename='add_post')change_post = Permission.objects.get(codename='change_post')editors.permissions.add(add_post, change_post) # Add user to groupuser = User.objects.get(username='john')user.groups.add(editors) # Oreditors.user_set.add(user) # Check if user in groupif user.groups.filter(name='Editors').exists():    print("User is an editor") # Get all user permissions (including from groups)user_permissions = user.get_all_permissions() # Check permissionif user.has_perm('blog.add_post'):    print("Can add posts")

User Profile Extension

One-to-One Profile Model

# models.pyfrom django.contrib.auth.models import Userfrom django.db import models class Profile(models.Model):    user = models.OneToOneField(User, on_delete=models.CASCADE)    bio = models.TextField(max_length=500, blank=True)    birth_date = models.DateField(null=True, blank=True)    avatar = models.ImageField(upload_to='avatars/', blank=True)    phone = models.CharField(max_length=20, blank=True)    website = models.URLField(blank=True)        def __str__(self):        return f'{self.user.username} Profile' # Signal to auto-create profilefrom django.db.models.signals import post_savefrom django.dispatch import receiver @receiver(post_save, sender=User)def create_user_profile(sender, instance, created, **kwargs):    if created:        Profile.objects.create(user=instance) @receiver(post_save, sender=User)def save_user_profile(sender, instance, **kwargs):    instance.profile.save() # Access in viewsdef profile_view(request):    profile = request.user.profile    return render(request, 'profile.html', {'profile': profile}) # Update profile@login_requireddef edit_profile(request):    if request.method == 'POST':        user_form = UserUpdateForm(request.POST, instance=request.user)        profile_form = ProfileUpdateForm(            request.POST,             request.FILES,             instance=request.user.profile        )                if user_form.is_valid() and profile_form.is_valid():            user_form.save()            profile_form.save()            messages.success(request, 'Profile updated!')            return redirect('profile')    else:        user_form = UserUpdateForm(instance=request.user)        profile_form = ProfileUpdateForm(instance=request.user.profile)        return render(request, 'edit_profile.html', {        'user_form': user_form,        'profile_form': profile_form    })

Bài Tập

Bài 1: Complete Authentication System

Task: Tạo hệ thống authentication hoàn chỉnh:

# Implement:# 1. Login page with remember me checkbox# 2. Registration with email verification (send welcome email)# 3. Logout with confirmation# 4. Change password with old password verification# 5. Password reset via email# 6. User profile page showing user info# 7. Edit profile page (username, email, first_name, last_name) # Requirements:# - Custom templates for all pages# - Proper error messages# - Success messages# - Redirect to 'next' parameter after login# - Auto-login after registration

Bài 2: User Profile with Avatar

Task: Extend User với Profile model:

# Create Profile model with:# - bio (TextField)# - birth_date (DateField)# - avatar (ImageField)# - phone (CharField)# - location (CharField) # Implement:# 1. Auto-create profile when user registers# 2. Profile view page# 3. Edit profile form (separate from User form)# 4. Avatar upload and display# 5. Default avatar if none uploaded# 6. Validate birth_date (must be 18+)

Bài 3: Permissions System

Task: Implement permissions cho blog:

# Setup:# - Author group: Can add/change own posts# - Editor group: Can add/change/delete any posts# - Admin: All permissions # Implement:# 1. Check if user can edit post (must be author or editor)# 2. Check if user can delete post (must be admin or editor)# 3. Show/hide edit/delete buttons based on permissions# 4. Create custom permission: 'can_publish_post'# 5. Only users with 'can_publish_post' can set published=True

Task: Add login with social accounts:

# Using django-allauth:# 1. Install and configure django-allauth# 2. Enable Google and GitHub login# 3. Create social login buttons# 4. Link social accounts to existing users# 5. Display connected accounts in profile# 6. Allow disconnecting social accounts # Bonus:# - Get avatar from social account# - Pre-fill profile info from social account

Tài Liệu Tham Khảo

Previous: Bài 13: Model Forms | Next: Bài 15: Sessions and Cookies

#user-model

Django Authentication Basics