Django includes a complete, built-in authentication system (django.contrib.auth) handling users, passwords, sessions/login, and permissions — another "batteries-included" feature that saves you from building (and getting wrong) this security-critical functionality.
from django.contrib.auth.models import User
# passwords are HASHED automatically — never store plaintext
user = User.objects.create_user(username="ann", email="[email protected]", password="secret")
user.set_password("newpassword") # always use set_password (it hashes)
user.check_password("secret") # verify a password (constant-time)
The built-in User model handles secure password hashing automatically (using strong algorithms like PBKDF2) — you never store or compare plaintext passwords, eliminating a major security risk.
from django.contrib.auth import authenticate, login, logout
def login_view(request):
user = authenticate(request, username=username, password=password) # verify credentials
if user is not None:
login(request, user) # establish a SESSION (sets request.user)
return redirect("home")
# else: invalid credentials
def logout_view(request):
logout(request) # clear the session
authenticate() verifies credentials, and login() establishes a session — after which request.user is the logged-in user on every request (via the authentication middleware).
from django.contrib.auth.decorators import login_required
@login_required # redirect to login if not authenticated
def dashboard(request):
return render(request, "dashboard.html", {"user": request.user})
# for class-based views:
from django.contrib.auth.mixins import LoginRequiredMixin
class DashboardView(LoginRequiredMixin, ListView): ...
# checking permissions
request.user.is_authenticated # is someone logged in?
request.user.is_staff / is_superuser # role flags
request.user.has_perm("blog.add_article")# a specific permission
request.user.groups.all() # group membership (role-based access)
@permission_required("blog.add_article")
def create_article(request): ...
Django distinguishes authentication (who you are — login) from authorization (what you can do — permissions). It provides per-model permissions (add/change/delete/view), groups for role-based access, and decorators/mixins to enforce them.
✓ Ready-made views/URLs for login, logout, password change/reset (django.contrib.auth.urls)
✓ Customizable: a CUSTOM USER MODEL (recommended from the start) to add fields,
custom backends (e.g. authenticate via email or OAuth), password validators
Django's built-in authentication system is a major, security-critical feature that saves you from building one of the most error-prone and dangerous parts of a web application yourself.
Understanding it is essential because nearly every real application needs user accounts, login, and access control — and getting authentication wrong creates serious security vulnerabilities (plaintext passwords, weak hashing, session flaws).
Django's system handles these correctly out of the box: it hashes passwords securely (strong algorithms, never plaintext — you use create_user/set_password/check_password rather than handling passwords manually), manages sessions and login (authenticate/login, with request.user available everywhere via middleware), and provides authorization through a complete permissions and groups system.
Knowing how to create and authenticate users, protect views (@login_required, LoginRequiredMixin), and enforce authorization via permissions and groups (distinguishing authentication — who you are — from authorization — what you're allowed to do) is fundamental for building secure applications.
The system's extensibility — especially using a custom user model (strongly recommended from the project's start) to add fields, and custom backends for email/OAuth login — is important practical knowledge.
Because authentication is both ubiquitous and security-critical, and because Django provides a robust, correct, batteries-included solution, mastering its auth system is core knowledge that lets you build secure user-facing applications without reinventing (and risking) this foundational functionality.