Authentication introduction

Django ships a user model, login/logout views, password hashing, and permissions—django.contrib.auth. Most apps extend or replace the default User model early.

Essentials

• User model — username/email, password hash, is_staff, is_superuser
• @login_required decorator — redirect anonymous users
• LoginRequiredMixin for CBVs
• request.user — current user (AnonymousUser if logged out)

Password security

Never store plain passwords—Django uses PBKDF2/bcrypt/argon2. Use create_user() and set_password(), not manual hashing in views.

Important interview questions and answers

1. Q: AUTH_USER_MODEL?
   A: Setting pointing to custom user model—must set before first migrate.
2. Q: Session vs JWT?
   A: Django default is session cookie + server session store; JWT common for SPA/mobile with DRF.
3. Q: Permission checks?
   A: user.has_perm('app.change_article') or decorators/mixins—prefer permissions over hard-coded group names.

Self-check

1. How do you protect a view for logged-in users only?
2. Why never save passwords as plain text?

Pitfall: Set AUTH_USER_MODEL before your first migrate if you need a custom user—changing later is painful.