The simple, raw way to limit access to pages is to check request.user.is_authenticated() and either redirect to a login page:

from Django.shortcuts import redirect 
 
def my_view(request): 
    if not request.user.is_authenticated(): 
        return redirect('/login/?next=%s' % request.path) 
    # ... 

... or display an error message:

from Django.shortcuts import render 
 
def my_view(request): 
    if not request.user.is_authenticated(): 
        return render(request, 'books/login_error.html') 
    # ... 

As a shortcut, you can use the convenient login_required() decorator:

from Django.contrib.auth.decorators import login_required 
 
@login_required 
def my_view(request): 
    ... 

login_required() does the following:

By default, the path that the user should be redirected to upon successful authentication is stored in a query string parameter called next. If you would prefer to use a different name for this parameter, login_required() takes an optional redirect_field_name parameter:

from Django.contrib.auth.decorators import login_required 
 
@login_required(redirect_field_name='my_redirect_field') 
def my_view(request): 
    ... 

Note that if you provide a value to redirect_field_name, you will most likely need to customize your login template as well, since the template context variable which stores the redirect path will use the value of redirect_field_name as its key rather than next (the default). login_required() also takes an optional login_url parameter. Example:

from Django.contrib.auth.decorators import login_required 
 
@login_required(login_url='/accounts/login/') 
def my_view(request): 
    ... 

Note that if you don't specify the login_url parameter, you'll need to ensure that the LOGIN_URL and your login view are properly associated. For example, using the defaults, add the following lines to your URLconf:

from Django.contrib.auth import views as auth_views 
 
url(r'^accounts/login/$', auth_views.login), 

The LOGIN_URL also accepts view function names and named URL patterns. This allows you to freely remap your login view within your URLconf without having to update the setting.

Note: The login_required decorator does NOT check the is_active flag on a user.

To limit access based on certain permissions or some other test, you'd do essentially the same thing as described in the previous section. The simple way is to run your test on request.user in the view directly. For example, this view checks to make sure the user has an email in the desired domain:

def my_view(request): 
    if not request.user.email.endswith('@example.com'): 
        return HttpResponse("You can't leave a review for this book.") 
    # ... 

As a shortcut, you can use the convenient user_passes_test decorator:

from Django.contrib.auth.decorators import user_passes_test 
 
def email_check(user): 
    return user.email.endswith('@example.com') 
 
@user_passes_test(email_check) 
def my_view(request): 
    ... 

user_passes_test() takes a required argument: a callable that takes a User object and returns True if the user is allowed to view the page. Note that user_passes_test() does not automatically check that the User is not anonymous. user_passes_test() takes two optional arguments:

For example:

@user_passes_test(email_check, login_url='/login/') 
def my_view(request): 
    ... 

It's a relatively common task to check whether a user has a particular permission. For that reason, Django provides a shortcut for that case-the permission_required() decorator:

from Django.contrib.auth.decorators import permission_required 
 
@permission_required('reviews.can_vote') 
def my_view(request): 
    ... 

Just like the has_perm() method, permission names take the form <app label>.<permission codename> (that is reviews.can_vote for a permission on a model in the reviews application). The decorator may also take a list of permissions. Note that permission_required() also takes an optional login_url parameter. Example:

from Django.contrib.auth.decorators import permission_required 
 
@permission_required('reviews.can_vote', login_url='/loginpage/') 
def my_view(request): 
    ... 

As in the login_required() decorator, login_url defaults to LOGIN_URL. If the raise_exception parameter is given,the decorator will raise PermissionDenied, prompting the 403 (HTTP Forbidden) view instead of redirecting to the login page.

If your AUTH_USER_MODEL inherits from AbstractBaseUser, or implements its own get_session_auth_hash() method, authenticated sessions will include the hash returned by this function. In the AbstractBaseUser case, this is a Hash Message Authentication Code (HMAC) of the password field.

If the SessionAuthenticationMiddleware is enabled, Django verifies that the hash sent along with each request matches the one that's computed server-side. This allows a user to log out of all of their sessions by changing their password.

The default password change views included with Django, Django.contrib.auth.views.password_change() and the user_change_password view in the Django.contrib.auth admin, update the session with the new password hash so that a user changing their own password won't log themselves out. If you have a custom password change view and wish to have similar behavior, use this function:

Django.contrib.auth.decorators.update_session_auth_hash (request, user) 

This function takes the current request and the updated user object from which the new session hash will be derived and updates the session hash appropriately. Example usage:

from Django.contrib.auth import update_session_auth_hash 
 
def password_change(request): 
    if request.method == 'POST': 
        form = PasswordChangeForm(user=request.user, data=request.POST) 
        if form.is_valid(): 
            form.save() 
            update_session_auth_hash(request, form.user) 
    else: 
        ... 

Since get_session_auth_hash() is based on SECRET_KEY, updating your site to use a new secret will invalidate all existing sessions.