login_required decorator in Django - Mini Project: Build & Apply

Using the login_required Decorator in Django

📖 Scenario: You are building a simple Django web app where some pages should only be seen by users who have logged in. To protect these pages, you will use Django's login_required decorator.

🎯 Goal: Learn how to use the login_required decorator to restrict access to a view so that only logged-in users can see it.

📋 What You'll Learn

Create a Django view function named dashboard that returns a simple HTTP response.

Import and use the login_required decorator from django.contrib.auth.decorators.

Apply the login_required decorator to the dashboard view.

Add a URL pattern for the dashboard view in urls.py.

💡 Why This Matters

🌍 Real World

Many websites have pages that only logged-in users should see, like user dashboards, profiles, or settings. Protecting these pages is important for privacy and security.

💼 Career

Understanding how to restrict access to parts of a web app is a key skill for web developers working with Django or any web framework.

1

Create the dashboard view function

In your Django app's views.py, create a function called dashboard that takes a request parameter and returns an HttpResponse with the text "Welcome to your dashboard!". Import HttpResponse from django.http.

Django

from django.http import HttpResponse

# Create the dashboard view function
# Your code here

Hint

Remember to import HttpResponse and define a function named dashboard that returns it with the welcome text.

2

Import the login_required decorator

In views.py, add an import statement to import login_required from django.contrib.auth.decorators.

Django

from django.http import HttpResponse
# Import login_required decorator
# Your code here

def dashboard(request):
    return HttpResponse("Welcome to your dashboard!")

Hint

Use from django.contrib.auth.decorators import login_required to import the decorator.

3

Apply the login_required decorator to the dashboard view

Add the @login_required decorator above the dashboard function definition in views.py.

Django

from django.http import HttpResponse
from django.contrib.auth.decorators import login_required

# Add the login_required decorator here
# Your code here
def dashboard(request):
    return HttpResponse("Welcome to your dashboard!")

Hint

Place @login_required directly above the dashboard function.

4

Add a URL pattern for the dashboard view

In your app's urls.py, import the dashboard view and add a URL pattern for path dashboard/ that points to the dashboard view. Import path from django.urls.

Django

from django.urls import path
from .views import dashboard

# Add the URL pattern for dashboard
# Your code here

Hint

Use path('dashboard/', dashboard, name='dashboard') inside urlpatterns.

Practice

1. What is the main purpose of the @login_required decorator in Django?

easy

A. To restrict access to a view only to logged-in users

B. To automatically log out users after a timeout

C. To display a custom error message on login failure

D. To register a new user in the system

Solution

1. Step 1: Understand the role of @login_required

   This decorator is used to protect views so only authenticated users can access them.

2. Step 2: Compare options with the decorator's function

   Only To restrict access to a view only to logged-in users correctly describes restricting access to logged-in users.

3. Final Answer:

   To restrict access to a view only to logged-in users -> Option A

4. Quick Check:

   login_required restricts access = D [OK]

Hint: Remember: login_required means login needed to see page [OK]

Common Mistakes:

• Thinking it logs out users automatically
• Confusing it with user registration
• Assuming it shows error messages

2. Which of the following is the correct way to apply the @login_required decorator to a Django view function named dashboard?

easy

A. def login_required(dashboard):

B. @login_required\ndef dashboard(request):

C. dashboard = login_required(dashboard(request))

D. login_required @dashboard(request):

Solution

1. Step 1: Recall the syntax for decorators in Python

   Decorators are placed above the function with an @ symbol, like @login_required.

2. Step 2: Check which option uses this syntax correctly

   @login_required\ndef dashboard(request): correctly places @login_required above the function definition.

3. Final Answer:

   @login_required\ndef dashboard(request): -> Option B

4. Quick Check:

   Decorator syntax uses @ above function = A [OK]

Hint: Decorator always goes above function with @ [OK]

Common Mistakes:

• Trying to call decorator like a function without @
• Placing decorator after function definition
• Using invalid syntax like 'login_required @dashboard'

3. Given this Django view code snippet, what happens when an anonymous user tries to access /profile/?

@login_required
def profile(request):
    return HttpResponse('User Profile')

medium

A. The user is redirected to the login page

B. The user gets a 404 Not Found error

C. The user sees 'User Profile' page

D. The user sees a permission denied message

Solution

1. Step 1: Understand what @login_required does for anonymous users

   It redirects users who are not logged in to the login page.

2. Step 2: Match this behavior with the options

   The user is redirected to the login page correctly states the redirect to login page for anonymous users.

3. Final Answer:

   The user is redirected to the login page -> Option A

4. Quick Check:

   Anonymous user triggers redirect = C [OK]

Hint: Anonymous users get redirected, not error or content [OK]

Common Mistakes:

• Assuming anonymous users see the page content
• Thinking it returns 404 error
• Believing it shows permission denied instead of redirect

4. Identify the error in this Django view using @login_required:

from django.contrib.auth.decorators import login_required
from django.http import HttpResponse

@login_required()
def dashboard(request):
    return HttpResponse('Dashboard')

medium

A. Missing import for HttpResponse

B. Missing request parameter in function

C. Function name should be capitalized

D. Incorrect use of parentheses after @login_required

Solution

1. Step 1: Check the decorator usage syntax

   @login_required is used without parentheses unless passing arguments.

2. Step 2: Identify the incorrect parentheses usage

   Incorrect use of parentheses after @login_required points out the error of using @login_required() instead of @login_required.

3. Final Answer:

   Incorrect use of parentheses after @login_required -> Option D

4. Quick Check:

   Decorator without args has no () = B [OK]

Hint: Use @login_required without () unless arguments needed [OK]

Common Mistakes:

• Adding parentheses when not required
• Forgetting to import HttpResponse (not tested here)
• Changing function name case unnecessarily

5. You want to protect a class-based view DashboardView so only logged-in users can access it. Which is the correct way to apply login_required?

hard

A. Call login_required inside the dispatch method manually

B. Add @login_required above the class definition

C. Use LoginRequiredMixin as a parent class instead of login_required

D. Wrap the class with login_required(DashboardView) after defining it

Solution

1. Step 1: Recall how to protect class-based views in Django

   For class-based views, Django provides LoginRequiredMixin to enforce login.

2. Step 2: Evaluate the options for class-based view protection

   Use LoginRequiredMixin as a parent class instead of login_required correctly uses LoginRequiredMixin as a parent class, which is the standard pattern.

3. Final Answer:

   Use LoginRequiredMixin as a parent class instead of login_required -> Option C

4. Quick Check:

   Class views use mixins, not decorators = A [OK]

Hint: Use LoginRequiredMixin for class views, not @login_required [OK]

Common Mistakes:

• Trying to decorate class directly with @login_required
• Wrapping class after definition with login_required
• Manually calling login_required inside methods