Piye carane sistem autentikasi Django bisa gumana?

Question

Accepted Answer

Django kalebu sistem autentikasi lengkap sing wis dibangun (`django.contrib.auth`) sing nangani **pangguna**, **sandhi**, **sesi/login**, lan **idin** — fitur "baterai ana" liyane sing nglindungi sampeyan saka mbangun (lan njalari salah) fungsi sing kritis kanggo keamanan.

## Model User lan nggawé pangguna

```python
from django.contrib.auth.models import User

# passwords are HASHED automatically — never store plaintext
user = User.objects.create_user(username="ann", email="a@x.com", password="secret")
user.set_password("newpassword")        # always use set_password (it hashes)
user.check_password("secret")            # verify a password (constant-time)
```

Model `User` sing wis dibangun nangani **pemgrosesa sandhi aman** kanthi otomatis (nganggo algoritma kuwat kaya PBKDF2) — sampeyan ora jamak simpen utawa mbandingi sandhi teks polos, ngilangi risiko keamanan gedhe.

## Autentikasi lan login

```python
from django.contrib.auth import authenticate, login, logout

def login_view(request):
    user = authenticate(request, username=username, password=password)  # verify credentials
    if user is not None:
        login(request, user)             # establish a SESSION (sets request.user)
        return redirect("home")
    # else: invalid credentials

def logout_view(request):
    logout(request)                       # clear the session
```

`authenticate()` verifikasi kredensyal, lan `login()` nggawé sesi — sawise iku `request.user` punika pangguna sing wis mlebu ing saben kiriman (liwat middleware autentikasi).

## Nyengkuyung tilikan (mbutuhake login)

```python
from django.contrib.auth.decorators import login_required

@login_required                          # redirect to login if not authenticated
def dashboard(request):
    return render(request, "dashboard.html", {"user": request.user})

# for class-based views:
from django.contrib.auth.mixins import LoginRequiredMixin
class DashboardView(LoginRequiredMixin, ListView): ...
```

## Idin lan otorisasi

```python
# checking permissions
request.user.is_authenticated            # is someone logged in?
request.user.is_staff / is_superuser     # role flags
request.user.has_perm("blog.add_article")# a specific permission
request.user.groups.all()                 # group membership (role-based access)

@permission_required("blog.add_article")
def create_article(request): ...
```

Django beda-bedaake **autentikasi** (apa sampeyan — login) saka **otorisasi** (apa sing bisa sampeyan gawe — idin). Iki nyedhiyaake idin saben-model (nambah/owah/busak/ndelok), klompok kanggo akses berbasis peran, lan dekorator/mixin kanggo nggendhani.

## Tilikan auth sing wis dibangun lan kustomisasi

```text
✓ Ready-made views/URLs for login, logout, password change/reset (django.contrib.auth.urls)
✓ Customizable: a CUSTOM USER MODEL (recommended from the start) to add fields,
  custom backends (e.g. authenticate via email or OAuth), password validators
```

## Apa sing penting

Sistem autentikasi sing wis dibangun Django punika fitur gedhe, kritis kanggo keamanan, sing nglindungi sampeyan saka mbangun salah sawijining bagian paling rawan lan mbahayani saka aplikasi web. Ngerti sistem iki kuwajiban amarga meh kabeh aplikasi nyata mbutuhake akun pangguna, login, lan kontrol akses — lan yen salah **nggawé kerentanan keamanan serius** (sandhi teks polos, pemgrosesa lemah, cacat sesi). Sistem Django nangani iki kanthi bener saka awal: iku **pemgrosesa sandhi aman** (algoritma kuwat, ora jamak teks polos — sampeyan nganggo `create_user`/`set_password`/`check_password` tinimbang nangani sandhi kanthi manual), nataleni sesi lan login (`authenticate`/`login`, karo `request.user` ana ing gunung liwat middleware), lan nyedhiyaake otorisasi liwat sistem **idin lan klompok** lengkap. Ngerti carane nggawé lan autentikasi pangguna, nyengkuyung tilikan (`@login_required`, `LoginRequiredMixin`), lan nggendhani **otorisasi** liwat idin lan klompok (bedaake autentikasi — apa sampeyan — saka otorisasi — apa sing diidini sampeyan gawe) punika pangankalan kanggo mbangun aplikasi aman. Keluwaran sistem — luwih-luwih nganggo **model pangguna khusus** (disaranake kuwat saka awal proyek) kanggo nambah katrangan, lan backend khusus kanggo login email/OAuth — punika katrangan praktis penting. Amarga autentikasi iku kasarian lan kritis kanggo keamanan, lan amarga Django nyedhiyaake solusi robust, bener, "baterai ana", nguwasai sistem auth Django punika katrangan inti sing ngluwari sampeyan mbangun aplikasi ngadhepi pangguna aman tanpa nambah (lan nyenggutake) fungsi lantaran iki.