Authentication middleware in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What does this Django authentication middleware do?

Consider this Django middleware snippet that checks user authentication status. What will be the behavior when an unauthenticated user accesses a protected view?

Django

class SimpleAuthMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        if not request.user.is_authenticated:
            from django.http import HttpResponseForbidden
            return HttpResponseForbidden('Access denied')
        response = self.get_response(request)
        return response

A The middleware redirects unauthenticated users to the login page automatically.

B The middleware blocks unauthenticated users by returning a 403 Forbidden response.

C The middleware allows all users to access the view without restriction.

D The middleware raises an exception if the user is not authenticated.

💡 Hint

Look at the response returned when the user is not authenticated.

The middleware checks if the user is authenticated. If not, it returns an HttpResponseForbidden, which sends a 403 status code blocking access.

📝 Syntax

intermediate

Identify the syntax error in this Django middleware snippet

Which option correctly fixes the syntax error in this middleware code?

Django

class AuthCheckMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        if not request.user.is_authenticated:
            from django.http import HttpResponseRedirect
            return HttpResponseRedirect('/login/')
        return self.get_response(request)

A Add a colon at the end of the if statement line.

B Indent the import statement one level less.

C Replace __call__ with process_request method.

D Remove the return statement inside the if block.

💡 Hint

Check the if statement syntax carefully.

The if statement is missing a colon at the end, which is required in Python syntax.

❓ state_output

advanced

What is the value of request.user after this middleware runs?

Given this middleware that modifies the request user attribute, what will be the value of request.user in the view after middleware processing?

Django

class FakeUserMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        class FakeUser:
            is_authenticated = True
            username = 'guest'
        request.user = FakeUser()
        response = self.get_response(request)
        return response

A An object with is_authenticated True and username 'guest'.

B The original user object from the request.

C None, because request.user is deleted.

D A string 'guest' instead of a user object.

💡 Hint

Look at how request.user is assigned inside the middleware.

The middleware replaces request.user with a new FakeUser object having is_authenticated True and username 'guest'.

🔧 Debug

advanced

Why does this authentication middleware cause a server error?

This middleware is intended to block unauthenticated users but causes a server error. What is the cause?

Django

class AuthMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        if not request.user.is_authenticated:
            return redirect('/login/')
        return self.get_response(request)

A request.user.is_authenticated is not a valid attribute.

B The middleware should use HttpResponseRedirect instead of redirect.

C Middleware must not return a response directly.

D The redirect function is not imported, causing a NameError.

💡 Hint

Check if all functions used are properly imported.

The redirect function is used but not imported from django.shortcuts, causing a NameError at runtime.

🧠 Conceptual

expert

Which statement best describes Django authentication middleware behavior?

Select the most accurate description of how Django's built-in AuthenticationMiddleware works.

A It encrypts user credentials on every request to enhance security.

B It automatically redirects unauthenticated users to the login page for all views.

C It attaches a user object to every request, representing the currently logged-in user or an anonymous user if not logged in.

D It replaces the session middleware and manages sessions internally.

💡 Hint

Think about what request.user contains after AuthenticationMiddleware runs.

AuthenticationMiddleware adds a user attribute to the request, which is either the logged-in user or an anonymous user object. It does not redirect or encrypt credentials.