Authentication

You've been using Django's built-in authentication system since lesson 6, every time you logged into the admin site. django.contrib.auth gives you user accounts, password hashing, login/logout views, and a way to check who's signed in — all ready to use in your own pages, too.

Logging in

Django provides a ready-made login view — you only need to supply the template:

from django.contrib.auth import views as auth_views

urlpatterns = [
    # ... your other patterns
    path('login/', auth_views.LoginView.as_view(), name='login'),
    path('logout/', auth_views.LogoutView.as_view(), name='logout'),
]

<form method="post">
    {% csrf_token %}
    {{ form.as_p }}
    <button type="submit">Log in</button>
</form>

LoginView handles checking the username and password against the database, hashing comparisons included, and starting the session — none of that logic is something you write by hand.

Checking who's logged in

Every request has a request.user attribute — either the logged-in User, or an AnonymousUser if nobody's signed in:

def dashboard(request):
    if request.user.is_authenticated:
        message = f"Welcome back, {request.user.username}!"
    else:
        message = "Please log in."
    return render(request, 'dashboard.html', {'message': message})

request.user.is_authenticated is the standard check — it works safely for both real users and AnonymousUser, unlike checking request.user is not None, which would always be true either way.

Restricting a whole view

For a view that should only be reachable while logged in, the @login_required decorator is simpler than checking is_authenticated yourself:

from django.contrib.auth.decorators import login_required

@login_required
def dashboard(request):
    return render(request, 'dashboard.html', {'user': request.user})

Redirects to /accounts/login/?next=/dashboard/

An anonymous visitor hitting a @login_required view is redirected straight to the login page, with the original URL preserved in ?next= — so after logging in, Django sends them right back to the page they were trying to reach.