9. Sessions and Authentication

Overview

This chapter begins with a brief introduction to middleware before delving into the concepts of authentication models and session engines. You will implement Django's authentication model to restrict permissions to only a specific set of users. Then, you will see how you can leverage Django authentication to provide a flexible approach to application security. After that, you will learn how Django supports multiple session engines to retain user data. By the end of the chapter, you will be proficient at using sessions to retain information on past user interactions and to maintain user preferences for when pages are revisited.

Introduction

Up until now, we have used Django to develop dynamic applications that allow users to interact with application models, but we have not attempted to secure these applications from unwanted use. For example, our Bookr app allows unauthenticated users to add reviews and upload media. This is a critical security issue for any online web app as it leaves the site open to the posting of spam or other inappropriate material and the vandalism of existing content. We want the creation and modification of content to be strictly limited to authenticated users who have registered with the site.

The authentication app supplies Django with the models for representing users, groups, and permissions. It also provides middleware, utility functions, decorators, and mixins that help integrate user authentication into our apps. Furthermore, the authentication app allows grouping and naming certain sets of users.

In Chapter 4, Introduction to Django Admin, we used the Admin app to...

Middleware

In Chapter 3, URL Mapping, Views, and Templates, we discussed Django's implementation of the request/response process along with its view and rendering functionality. In addition to these, another feature that plays an extremely important role when it comes to Django's core web processing is middleware. Django's middleware refers to a variety of software components that intervene in this request/response process to integrate important functionalities such as security, session management, and authentication.

So, when we write a view in Django, we don't have to explicitly set a series of important security features in the response header. These additions to the response object are automatically made by the SecurityMiddleware instance after the view returns its response. As middleware components wrap the view and perform a series of pre-processes on the request and post-processes on the response, the view is not cluttered with a lot of repetitive code...

Sessions

It is worth looking at some theory to understand why sessions are a common solution in web applications for managing user content. The HTTP protocol defines the interactions between a client and a server. It is said to be a "stateless" protocol as no stateful information is retained by the server between requests. This protocol design worked well for delivering hypertextual information in the early days of the World Wide Web, but it did not suit the needs of secured web applications delivering customized information to specific users.

We are now acquainted with seeing websites adapt to our personal viewing habits. Shopping sites recommend similar products to the ones that we have recently viewed and tell us about products that are popular in our region. These features all required a stateful approach to website development. One of the most common ways to implement a stateful web experience is through sessions. A session refers to a user's current interaction...

Summary

In this chapter, we have examined Django's middleware implementation of authentication and sessions. We have learned how to incorporate authentication and permission logic into views and templates. We can set permissions on specific pages and limit their access to authenticated users. We have also examined how to store data in a user's session and render it in subsequent pages.

Now you have the skills to customize a Django project to deliver a personalized web experience. You can limit the content to authenticated or privileged users and you can personalize a user's experience based on their prior interactions. In the next chapter, we will revisit the Admin app and learn some advanced techniques to customize our user model and apply fine-grained changes to the admin interface for our models.