Django's authentication system yaya ke aiki?

Question

Accepted Answer

Django ya haɗa cikakken, gida mai jiya **authentication system** (`django.contrib.auth`) wanda ke gudanarwa da **users**, **passwords**, **sessions/login**, da **permissions** — wani nau'i na "batteries-included" wanda ke kuɓuta ka daga gina (da kuma kuskure) wannan muhimmin aiki na tsaro.

## User model da ƙirƙira users

```python
from django.contrib.auth.models import User

# passwords are HASHED automatically — never store plaintext
user = User.objects.create_user(username="ann", email="a@x.com", password="secret")
user.set_password("newpassword")        # always use set_password (it hashes)
user.check_password("secret")            # verify a password (constant-time)
```

`User` model na gida ya gudanar **password hashing** a cikin jiya (ta amfani da ƙarfin algorithms kamar PBKDF2) — ba ka waje ko kwatantawa da plaintext passwords, wanda ke kawar da babbar haɗarin tsaro.

## Shaidawa da shiga cikin jiya

```python
from django.contrib.auth import authenticate, login, logout

def login_view(request):
    user = authenticate(request, username=username, password=password)  # verify credentials
    if user is not None:
        login(request, user)             # establish a SESSION (sets request.user)
        return redirect("home")
    # else: invalid credentials

def logout_view(request):
    logout(request)                       # clear the session
```

`authenticate()` ya tabbatar da credentials, da `login()` ya kafa session — bayan haka `request.user` shine mai shiga jiya akan kowane buɗe (ta hanyar authentication middleware).

## Kariye views (buƙatar shiga)

```python
from django.contrib.auth.decorators import login_required

@login_required                          # redirect to login if not authenticated
def dashboard(request):
    return render(request, "dashboard.html", {"user": request.user})

# for class-based views:
from django.contrib.auth.mixins import LoginRequiredMixin
class DashboardView(LoginRequiredMixin, ListView): ...
```

## Izini da ƙarni

```python
# checking permissions
request.user.is_authenticated            # is someone logged in?
request.user.is_staff / is_superuser     # role flags
request.user.has_perm("blog.add_article")# a specific permission
request.user.groups.all()                 # group membership (role-based access)

@permission_required("blog.add_article")
def create_article(request): ...
```

Django ya bambanta **authentication** (wanene ka — shiga) daga **authorization** (abin da ka iya yi — izini). Ya ba da izini per-model (add/change/delete/view), ƴiwa don muhimman halin gida, da decorators/mixins don tilasta su.

## Gida auth views da gyara

```text
✓ Ready-made views/URLs for login, logout, password change/reset (django.contrib.auth.urls)
✓ Customizable: a CUSTOM USER MODEL (recommended from the start) to add fields,
  custom backends (e.g. authenticate via email or OAuth), password validators
```

## Me yasa ya kamata

Django's built-in authentication system shafi babbar, muhimmin aiki na tsaro wanda ke kuɓuta ka daga gina ɗaya daga mafi dangantacewar da hadari sassan aikacin gida na yanar gizo kanka.
\