---
title: "Django中的用户认证"
version: 2.1
locale: zh-hans
source: https://docs.djangoproject.com/zh-hans/2.1/topics/auth/
canonical: https://djangodocs.dev/zh-hans/2.1/topics/auth/
---
# Django中的用户认证

Django comes with a user authentication system. It handles user accounts,
groups, permissions and cookie-based user sessions. This section of the
documentation explains how the default implementation works out of the box, as
well as how to [extend and customize](/zh-hans/2.1/topics/auth/customizing/) it to
suit your project's needs.

## 概况

The Django authentication system handles both authentication and authorization.
Briefly, authentication verifies a user is who they claim to be, and
authorization determines what an authenticated user is allowed to do. Here the
term authentication is used to refer to both tasks.

认证系统由以下部分组成：

- Users
- Permissions: Binary (yes/no) flags designating whether a user may perform
  a certain task.
- Groups: A generic way of applying labels and permissions to more than one
  user.
- A configurable password hashing system
- Forms and view tools for logging in users, or restricting content
- A pluggable backend system

The authentication system in Django aims to be very generic and doesn't provide
some features commonly found in web authentication systems. Solutions for some
of these common problems have been implemented in third-party packages:

- 密码强度检查
- 限制登录尝试
- 针对第三方的身份验证（例如OAuth）
- Object-level permissions

## 安装

Authentication support is bundled as a Django contrib module in
`django.contrib.auth`. By default, the required configuration is already
included in the `settings.py` generated by [`django-admin
startproject`](/zh-hans/2.1/ref/django-admin/#django-admin-startproject), these consist of two items listed in your
[`INSTALLED_APPS`](/zh-hans/2.1/ref/settings/#std-setting-INSTALLED_APPS) setting:

1. `'django.contrib.auth'` contains the core of the authentication framework,
   and its default models.
2. `'django.contrib.contenttypes'` is the Django [content type system](/zh-hans/2.1/ref/contrib/contenttypes/), which allows permissions to be associated with
   models you create.

and these items in your [`MIDDLEWARE`](/zh-hans/2.1/ref/settings/#std-setting-MIDDLEWARE) setting:

1. [`SessionMiddleware`](/zh-hans/2.1/ref/middleware/#django.contrib.sessions.middleware.SessionMiddleware) manages
   [sessions](/zh-hans/2.1/topics/http/sessions/) across requests.
2. [`AuthenticationMiddleware`](/zh-hans/2.1/ref/middleware/#django.contrib.auth.middleware.AuthenticationMiddleware) associates
   users with requests using sessions.

有了这些设置，运行命令 `manage.py migrate` 为auth相关模型创建必要的数据表，并为已安装应用中定义的任何模型创建许可。

## Usage

[Using Django's default implementation](/zh-hans/2.1/topics/auth/default/)

- [Working with User objects](/zh-hans/2.1/topics/auth/default/#user-objects)
- [Permissions and authorization](/zh-hans/2.1/topics/auth/default/#topic-authorization)
- [Authentication in web requests](/zh-hans/2.1/topics/auth/default/#auth-web-requests)
- [Managing users in the admin](/zh-hans/2.1/topics/auth/default/#auth-admin)

[API reference for the default implementation](/zh-hans/2.1/ref/contrib/auth/)

[Customizing Users and authentication](/zh-hans/2.1/topics/auth/customizing/)

[Password management in Django](/zh-hans/2.1/topics/auth/passwords/)