Django inajumuisha mfumo kamili wa authentication uliojengwa ndani (django.contrib.auth) unaoshughulikia users, passwords, sessions/login, na permissions — kipengele kingine cha "batteries-included" kinachokuokoa kutoka kujenga (na kukosea) utendaji huu muhimu kwa usalama.
from django.contrib.auth.models import User
# passwords are HASHED automatically — never store plaintext
user = User.objects.create_user(username="ann", email="[email protected]", password="secret")
user.set_password("newpassword") # always use set_password (it hashes)
user.check_password("secret") # verify a password (constant-time)
User model iliyojengwa ndani inashughulikia password hashing salama kiotomatiki (kwa kutumia algorithms imara kama PBKDF2) — hauhifadhi au kulinganisha passwords za plaintext kamwe, ukiondoa hatari kubwa ya usalama.
from django.contrib.auth import authenticate, login, logout
def login_view(request):
user = authenticate(request, username=username, password=password) # verify credentials
if user is not None:
login(request, user) # establish a SESSION (sets request.user)
return redirect("home")
# else: invalid credentials
def logout_view(request):
logout(request) # clear the session
authenticate() inathibitisha credentials, na login() inaanzisha session — baada ya hapo request.user ndiye mtumiaji aliyeingia kwenye kila request (kupitia authentication middleware).
from django.contrib.auth.decorators import login_required
@login_required # redirect to login if not authenticated
def dashboard(request):
return render(request, "dashboard.html", {"user": request.user})
# for class-based views:
from django.contrib.auth.mixins import LoginRequiredMixin
class DashboardView(LoginRequiredMixin, ListView): ...
# checking permissions
request.user.is_authenticated # is someone logged in?
request.user.is_staff / is_superuser # role flags
request.user.has_perm("blog.add_article")# a specific permission
request.user.groups.all() # group membership (role-based access)
@permission_required("blog.add_article")
def create_article(request): ...
Django inatofautisha authentication (wewe ni nani — login) na authorization (unachoweza kufanya — permissions). Inatoa permissions za kila model (add/change/delete/view), groups kwa ufikiaji unaozingatia majukumu, na decorators/mixins za kuzitekeleza.
✓ Ready-made views/URLs for login, logout, password change/reset (django.contrib.auth.urls)
✓ Customizable: a CUSTOM USER MODEL (recommended from the start) to add fields,
custom backends (e.g. authenticate via email or OAuth), password validators
Mfumo wa authentication wa Django uliojengwa ndani ni kipengele kikubwa, muhimu kwa usalama kinachokuokoa kutoka kujenga mojawapo ya sehemu zenye makosa na hatari zaidi za programu ya wavuti wewe mwenyewe.
Kuuelewa ni muhimu kwa sababu karibu kila programu halisi inahitaji akaunti za watumiaji, login, na udhibiti wa ufikiaji — na kukosea authentication kunaunda udhaifu mkubwa wa usalama (passwords za plaintext, hashing dhaifu, dosari za session).
Mfumo wa Django unashughulikia haya kwa usahihi moja kwa moja: una-hash passwords kwa usalama (algorithms imara, kamwe si plaintext — unatumia create_user/set_password/check_password badala ya kushughulikia passwords kwa mkono), unasimamia sessions na login (authenticate/login, na request.user ikipatikana kila mahali kupitia middleware), na unatoa authorization kupitia mfumo kamili wa permissions na groups.
Kujua jinsi ya kuunda na kuthibitisha users, kulinda views (@login_required, LoginRequiredMixin), na kutekeleza authorization kupitia permissions na groups (kutofautisha authentication — wewe ni nani — na authorization — unachoruhusiwa kufanya) ni jambo la msingi kwa kujenga programu salama.
Unyumbufu wa mfumo — hasa kutumia custom user model (inapendekezwa sana tangu mwanzo wa mradi) kuongeza fields, na custom backends kwa email/OAuth login — ni maarifa muhimu ya kivitendo.
Kwa sababu authentication ni jambo lililoenea na muhimu kwa usalama, na kwa sababu Django inatoa suluhisho imara, sahihi, la batteries-included, kumudu mfumo wake wa auth ni maarifa ya msingi yanayokuruhusu kujenga programu salama zinazoelekea watumiaji bila kubuni upya (na kuhatarisha) utendaji huu wa msingi.