Django comes with a user authentication system. It handles user accounts,\ngroups, permissions and cookie-based user sessions. This section of the\ndocumentation explains how the default implementation works out of the box, as\nwell as how to extend and customize it to\nsuit your project’s needs.
\nThe Django authentication system handles both authentication and authorization.\nBriefly, authentication verifies a user is who they claim to be, and\nauthorization determines what an authenticated user is allowed to do. Here the\nterm authentication is used to refer to both tasks.
\nThe auth system consists of:
\nUsers
Permissions: Binary (yes/no) flags designating whether a user may perform\na certain task.
Groups: A generic way of applying labels and permissions to more than one\nuser.
A configurable password hashing system
Forms and view tools for logging in users, or restricting content
A pluggable backend system
The authentication system in Django aims to be very generic and doesn’t provide\nsome features commonly found in web authentication systems. Solutions for some\nof these common problems have been implemented in third-party packages:
\nPassword strength checking
Throttling of login attempts
Authentication against third-parties (OAuth, for example)
Object-level permissions
Authentication support is bundled as a Django contrib module in\ndjango.contrib.auth. By default, the required configuration is already\nincluded in the settings.py generated by django-admin\nstartproject, these consist of two items listed in your\nINSTALLED_APPS setting:
'django.contrib.auth' contains the core of the authentication framework,\nand its default models.
'django.contrib.contenttypes' is the Django content type system, which allows permissions to be associated with\nmodels you create.
and these items in your MIDDLEWARE setting:
SessionMiddleware manages\nsessions across requests.
AuthenticationMiddleware associates\nusers with requests using sessions.
With these settings in place, running the command manage.py migrate creates\nthe necessary database tables for auth related models and permissions for any\nmodels defined in your installed apps.
Using Django’s default implementation
\nAPI reference for the default implementation
\n\n\n