Sessions and Authentication

So far, we have used Django to develop dynamic applications that allow users to interact with application models, but we have not attempted to secure these applications from unwanted use. For example, our Bookr app allows unauthenticated users to add reviews and upload media. This is a critical security issue for any online web app as it leaves the site open to the posting of spam or other inappropriate material and the vandalism of existing content. We want the creation and modification of content to be strictly limited to authenticated users who have registered with the site.

The authentication app supplies Django with the models for representing users, groups, and permissions. It also provides middleware, utility functions, decorators, and mixins that help us integrate user authentication into our apps. Furthermore, the authentication app allows us to group and name certain sets of users.

In Chapter 4, Introduction to Django Admin, we used the...