Made withDjangoClip

Django Tutorial - Login, Logout and User Authentication

T

Tech With Tim

Creator on the Django channel

Watch on YouTube ↗

143K viewsApr 29, 201913:44 runtime

Learn how to implement robust user authentication in your Django projects by leveraging built-in features for login and logout. This tutorial guides you through creating login templates, integrating Django's `contrib.auth` URLs, and customizing redirects after login or logout…

Chapters

#django#clip#frameworks

Key Concepts for Django User Authentication

This document summarizes the core steps for implementing login, logout, and user authentication in a Django application.

1. Activating Django's Auth URLs

Django provides a built-in set of views and URLs for handling common authentication tasks.

To use them, include the django.contrib.auth.urls in your project's main urls.py file.

# my_site/urls.py
from django.urls import path, include

urlpatterns = [
    # ... your other urls
    path('', include('django.contrib.auth.urls')),
]

2. Creating Authentication Templates

Django's authentication views automatically look for templates in a specific location.

Note
You must create a registration folder inside one of your app's templates directories. The login template must be named login.html. Example path: my_app/templates/registration/login.html

The login.html template should contain a form that posts to the login view. The view passes a form object to the template context automatically.

{% extends 'main/base.html' %}
{% load crispy_forms_tags %}

{% block content %}
  <form method="post">
    {% csrf_token %}
    {{ form|crispy }}
    <button type="submit" class="btn btn-success">Login</button>
  </form>
  <p>Don't have an account? <a href="/register">Create one here</a>.</p>
{% endblock %}

3. Configuring Redirects

After a successful login or logout, Django needs to know where to send the user.

Important
By default, Django redirects to /accounts/profile/ after login. If this route doesn't exist, you'll get a 404 error. Configure these settings in your settings.py file.

LOGIN_REDIRECT_URL: Specifies the path to redirect to after a successful login. '/' is a common choice for the homepage.
LOGOUT_REDIRECT_URL: Specifies the path to redirect to after logging out. This can also be set to the homepage or a dedicated "Logged Out" page.

# settings.py

LOGIN_REDIRECT_URL = '/'
LOGOUT_REDIRECT_URL = '/'

4. Checking Authentication Status

You can check if the current user is logged in within both templates and views.

In Templates: The user object is available in the template context. Use the user.is_authenticated boolean attribute to conditionally display content.

{% if user.is_authenticated %}
    <p>Welcome, {{ user.username }}!</p>
    <a href="/logout">Logout</a>
{% else %}
    <p>You are not logged in.</p>
    <a href="/login">Login</a>
{% endif %}

In Views: The request object contains the current user.

Tip
The video mentions response.user, but the correct way to access the user in a view is through the request object: request.user. The request.user object will be an instance of the User model if logged in, or an AnonymousUser object if not.

# views.py
def my_view(request):
    if request.user.is_authenticated:
        # Do something for logged in users
        pass
    # ...

Introduction to User Authentication

Hey guys and welcome back to another Django tutorial. So in today's video, what we'll be doing is talking about logging in and authenticating users. I will also show you how we can only restrict pages so that users that are logged in can see them. So for example, we maybe don't want a user that's not logged in to be able to create a new to-do list, because that probably won't work. So how we can do stuff like that.

And then in the next video, what I'm going to be doing is talking about creating a custom user model, which means that we can add things like all of our to-do lists to a specific user so that each user has their own to-do list. And when they go on the website, they're going to see a different to-do list, not just all of the ones that have been created by any user. That's what we'll be doing in the next one, but this one will just be logging in, validating, and logging out as well.

Integrating Django's Built-in Auth URLs

So, what we actually need to do first of all when we're going to be logging in and logging out is we need to create those login and logout pages. Now, luckily for us, Django actually does a lot of this work for us. They have a built-in application and if I show you in settings.py here, that is django.contrib.auth. And what this does is it authenticates users. So, we've done all the hard work of creating new users, but now since we've done that, Django can actually authenticate those for us. So, we can use some of the built-in things in this application to do that for us.

So, the first step and what we want to do is we actually want to use some built-in pages that Django's made. So, they actually have made log out, login, what is it? Change password, like a ton of different pages like that that we can access simply by linking to them in our URL patterns from our main URLs file inside of my site. So, what I'm going to do just like I've done to get into my other applications is I'm just going to say path and in this case include, but in here I'm going to say django.contrib.auth.urls. And I believe that's correct, but I will check that quickly to make sure I didn't mess that up. Uh, yes. So, that's correct.

So, what this will do now is it'll go to this application. It'll look in the URLs file there, and we'll see if we have a valid URL. So, if we have login, log out, change password, create password, a bunch of those different pages. Right now, we're just going to work with login and log out, but you know what I mean. So, that's what that'll do for us.

But the thing is these views, if we try to go to them now they actually don't exist. So what those templates attempt to do or what the views attempt to do is render a template called login.html, logout.html from a specific folder that we need to create. So what we actually need to do and it doesn't really matter where we do this but I'm going to do it from inside of my register application. So, inside of templates, I'm going to create a new folder. And in here, I'm going to call this registration like that. Um, now it's important that you spell registration correctly, like I just misspelled it, registration, because it's going to look for this specific folder. So, we're going to create a registration folder inside one of our templates folder. And then in here, we're going to create a new HTML file, and we're going to call this login.html.

Now, this is going to be where Django will look and what template it will use to render our login form. So what we'll do is we'll simply just do what we've done before. So we'll start by {% extends 'main/base.html' %} and then we'll add our blocks for our title and for our content. So let's do that now. {% block title %} and then we're going to say {% endblock %} like that. And then I guess we can do the title. We'll just do Login Here or something like that. And then, you know, I can just copy this. And we'll just change the name to content. And now we're just going to create a nice form in here that will display our form just like we've done probably four or five times by now.

So we'll say <form>. We're going to say method="post". And then we're going to say class="form-group". Now we can end our form like that. And then inside of here, we'll add our CSFR token or whatever that is. CSRF token. And we will simply display our form. Now, I want to add this to be a crispy form so it looks a bit nicer. So to do that, we'll have to load in our crispy tags. So we'll say {% load crispy_forms_tags %}. I believe that's the correct way to do that. If you don't have crispy forms installed, go back and watch the last video because we did that there. And then what we'll do is we'll add a filter here and we'll say as the filter, we'll just say crispy. And this will display a nice form for us. Now, we also need to add a button into our form because that doesn't come with it. So to do that, we'll say <button>. We'll say type="submit". And then I guess we'll say class="btn btn-success" and end our button and just say Login as the name.

Sweet. So that should be it for this login form. Now we actually may want to add one more thing because sometimes you go to a login page it says well rather than logging in like create an account if you don't have one. So maybe we'll add that in here quickly just make things look a bit nicer. So, we'll just add, I guess, some <p> tags. And I'll just say </p>. And I'm going to say Don't have an account? Create one. And then I'll add an <a> tag, which will just link to our create. So, I believe it was /register. We did. Was it /register /create? That was that URL. Let's check inside of where is it? Here. Uh, register. register is the name. Awesome. So let's go back here, register, and we'll say here, and then </a>. Sweet. So that should actually be it for the login page.

And now we can actually go ahead and run our server, which I already have running. And we will see that the login page is actually working. So this is the logout page. Let's go to login and see what we get. /login. Um. Oh. Well, if you spell extends incorrectly, extends. There you go. Then it won't work. Now, let's try it. If I refresh this here, there we go. So now you can see that we actually have a nice login page. And this took us all of what, 6 minutes to create. So it's pretty straightforward. And what will actually happen here is this will properly do our login and validate users for us. So let's try to log in. This is a valid login right now. Password 1 2 3 4. When I click login, you can see that it's actually directing me back to the homepage. Now, the reason that this is happening is because I actually have something added down here in my settings.py file that I forgot to like resave that was telling us to redirect to that page.

But let me just refresh this, let me go back to login and do this again because I want to show you what happens if you don't have that. You could see that it brings us to this no page not found which is probably what you guys were getting when you're running this. Now, that's because what happens is when we try to log in, it's going to automatically attempt to redirect us to a page called accounts/profile. Now, we obviously haven't created a page or a URL for accounts/profile. So, what we need to do is we need to modify where we're going to go once we log in. Now, the reason it was happening for me is cuz I had done that previously and forgot to save removing it. But, let's go inside our settings.py file inside of our mysite and let's add a redirect to let's say the homepage whenever we log in. So to do this I'm going to say in this case LOGIN_REDIRECT_URL equals and in this case you can pick wherever you'd like to go but I'm just going to do / standing for obviously the homepage. So let's do that.

Checking Authentication with `user.is_authenticated`

Now let's rerun and try to log in. And well, we will see that we should be directed directly to the homepage once we log in. Let's do that. And you can see we are brought to the homepage. So that's awesome. Now I'm just going to quickly move this up one because I don't like how that looks. Let's put this p-tag just above here. And now I want to refresh this. And that looks a little bit better to me. So sweet. That's how we log in.

Now let me show you what's actually happening in the back end when or how we can validate if we're logged in or not. because right now there's not really any way for us to tell whether or not we're logged in or we're logged out. So what I'm going to do is I'm going to go actually all the way back into my main application into templates and base.html and I'm going to create a thing that essentially only shows our main content body. So like this {% block content %} if we are logged in, otherwise it will tell us to log in and it'll leave a link that says login. So, a way that you can actually tell if a user is logged in or not is by using what's known as user.is_authenticated.

So, I can actually create a code block here. And I'm going to make this an if statement. I'm going to say {% if user.is_authenticated %}. I think I spelled that correctly. So what this does is by default whenever you go to a web page in Django it has a user attribute which stands for the current user. Now if there's no user signed in I believe it defaults to what's known as an anonymous user. So if you call user.is_authenticated on the user, if it is a valid user that's properly signed into the web page then this will return true. If it does not return true then the person is not signed in. So essentially, I only want to show this content block for all the different pages that I have if we're logged in. Otherwise, I want to ask the user to log in or even maybe redirect them to login.

So what I'll do here is now I'm going to put an {% else %} statement that'll say essentially else. So if you're not logged in, what we'll do is we'll literally just put an <a> tag. And you you guys could obviously make this look a lot nicer than I'm going to do. And we'll just link it to the login page and we'll say, log in here. And you can just click this whole thing. And you know what? Actually, let's put this in a <p> tag. Make it look a little bit nicer. </p> and instead of having the whole thing be a link, we'll just do login here. All right. So now we will hopefully redirect to the login page. And then last thing I need to do before I forget is just end this if block. So we'll say {% endif %}. And there we go.

So, let's now go back and let me go to home. And I don't think I'm currently logged in, but we'll see. And okay, so it is, I am currently logged in. So, what I want to do actually is just log out. So, log out brings us to this logout page, right? That just says thank you for logging out. This is the default logout page. I'm going to show you. We can change that in just a second. So, now let's go back to the web page and let's just go to the homepage. And you can see that now that I'm not logged in, it says log in here. If I click this, um, oh, okay. So, that is actually an issue. So, what's happening essentially is when I go to the login page, since we're not logged in, it's not showing the login page cuz that's the block content. So this is probably not the best way to do it, but this is how you can tell if someone is authenticated. So, maybe actually let me remove this. Um, yeah, because it won't let us log in if that is there. So let we'll remove this for now and just leave it as blog content. But that shows you guys how you can restrict kind of page access to people that are logged in. So obviously on certain pages you might want to add that if statement so that it's showing different stuff based on if you're logged in or if you're not logged in.

Logout Redirects and Accessing User in Views

But that is essentially kind of how you do log and log out. I'll really quickly show you how to change the logout page if you'd like to do that. So same thing as kind of changing the redirect here for login. So all we'll do is we'll just literally copy this and change this to LOGOUT_REDIRECT_URL and then here we can just define whatever page we want to go to when we log out. So if you had created a logout template, you could go to that. You could go to essentially whatever you want just by doing that. I'll just leave it as a homepage for now. Uh but you know, you get the idea.

So I guess the last thing I'll show you is let's say that you create some URLs inside of your new application. So maybe we go we have a URL and we have to create. So let's go to the create page for a second. Uh actually I want to go to views. My apologies. If we want to get the user from within code, we don't want it just inside of the HTML file. What we can actually do is we can type response.user. Now when you do response.user that will give you the user and you can run is_authenticated, you can get all the attributes of the user like the name, the password, the email, all that stuff directly from the code and then obviously you could pass that into the context of the page or you could do whatever you need to do with it from the back end. So I figured I'd show you how to do that quickly.

Conclusion and Next Steps

So anyways, that has kind of been it for logging in and logging out. Pretty straightforward. In the next video, we'll create a custom user model and we'll talk about how we can modify that model to add attributes like all the to-do list to a specific user. So anyways, that has been it for this video. I hope you guys enjoyed. If you did, please make sure you leave a like and subscribe and I will see you again in the next one.