login_required decorator in Django - Step-by-Step Execution

Concept Flow - login_required decorator

User sends request to view

↓

login_required checks if user is authenticated

↓

Allow access

↓

View executes

The login_required decorator checks if the user is logged in before allowing access to a view. If not logged in, it redirects to the login page.

Execution Sample

Django

@login_required
def dashboard(request):
    return HttpResponse('Welcome to your dashboard')

This code protects the dashboard view so only logged-in users can see it.

Execution Table

Step	Action	User Authenticated?	Result	Next Step
1	User sends request to dashboard view	Unknown	Check authentication	login_required decorator runs
2	login_required checks user authentication	Yes	Allow access	dashboard view executes
3	dashboard view returns response	Yes	HttpResponse with welcome message	Response sent to user
4	User sends request to dashboard view	Unknown	Check authentication	login_required decorator runs
5	login_required checks user authentication	No	Redirect to login page	Redirect response sent to user

💡 Execution stops after sending HttpResponse or redirecting to login page

Variable Tracker

Variable	Start	After Step 2	After Step 3 or 5
user.is_authenticated	Unknown	True or False	True or False
response	None	None	HttpResponse or HttpResponseRedirect

Key Moments - 2 Insights

Why does the user get redirected instead of seeing the dashboard?

Because login_required found user.is_authenticated is False at step 5, so it sends a redirect to the login page instead of running the view.

What happens if the user is authenticated?

At step 2, login_required sees user.is_authenticated is True, so it lets the dashboard view run and return the welcome message (step 3).

Visual Quiz - 3 Questions

Look at the execution table, what happens at step 5?

A Dashboard view returns welcome message

B Authentication is checked again

C User is redirected to login page

D User is logged out

💡 Hint

See row with Step 5 in execution_table where user is not authenticated

At which step does the dashboard view actually run?

A Step 2

B Step 3

C Step 1

D Step 5

💡 Hint

Look at execution_table row where dashboard view returns response

If the user is authenticated, what will the response variable hold after step 3?

A HttpResponse with welcome message

B None

C Redirect to login page

D Error message

💡 Hint

Check variable_tracker for response after step 3

Concept Snapshot

login_required decorator syntax:
@login_required
def view(request):
  # code

Behavior:
- Checks if user is logged in
- If yes, runs view
- If no, redirects to login page

Use to protect views needing login

Full Transcript

The login_required decorator in Django protects views by checking if the user is logged in. When a user requests a protected view, login_required first checks user.is_authenticated. If True, the view runs and returns its response. If False, the user is redirected to the login page. This ensures only logged-in users can access certain pages. The execution table shows these steps clearly: request arrives, authentication checked, then either view runs or redirect happens. Variables like user.is_authenticated and response change accordingly during execution.

Practice

1. What is the main purpose of the @login_required decorator in Django?

easy

A. To restrict access to a view only to logged-in users

B. To automatically log out users after a timeout

C. To display a custom error message on login failure

D. To register a new user in the system

Solution

1. Step 1: Understand the role of @login_required

   This decorator is used to protect views so only authenticated users can access them.

2. Step 2: Compare options with the decorator's function

   Only To restrict access to a view only to logged-in users correctly describes restricting access to logged-in users.

3. Final Answer:

   To restrict access to a view only to logged-in users -> Option A

4. Quick Check:

   login_required restricts access = D [OK]

Hint: Remember: login_required means login needed to see page [OK]

Common Mistakes:

• Thinking it logs out users automatically
• Confusing it with user registration
• Assuming it shows error messages

2. Which of the following is the correct way to apply the @login_required decorator to a Django view function named dashboard?

easy

A. def login_required(dashboard):

B. @login_required\ndef dashboard(request):

C. dashboard = login_required(dashboard(request))

D. login_required @dashboard(request):

Solution

1. Step 1: Recall the syntax for decorators in Python

   Decorators are placed above the function with an @ symbol, like @login_required.

2. Step 2: Check which option uses this syntax correctly

   @login_required\ndef dashboard(request): correctly places @login_required above the function definition.

3. Final Answer:

   @login_required\ndef dashboard(request): -> Option B

4. Quick Check:

   Decorator syntax uses @ above function = A [OK]

Hint: Decorator always goes above function with @ [OK]

Common Mistakes:

• Trying to call decorator like a function without @
• Placing decorator after function definition
• Using invalid syntax like 'login_required @dashboard'

3. Given this Django view code snippet, what happens when an anonymous user tries to access /profile/?

@login_required
def profile(request):
    return HttpResponse('User Profile')

medium

A. The user is redirected to the login page

B. The user gets a 404 Not Found error

C. The user sees 'User Profile' page

D. The user sees a permission denied message

Solution

1. Step 1: Understand what @login_required does for anonymous users

   It redirects users who are not logged in to the login page.

2. Step 2: Match this behavior with the options

   The user is redirected to the login page correctly states the redirect to login page for anonymous users.

3. Final Answer:

   The user is redirected to the login page -> Option A

4. Quick Check:

   Anonymous user triggers redirect = C [OK]

Hint: Anonymous users get redirected, not error or content [OK]

Common Mistakes:

• Assuming anonymous users see the page content
• Thinking it returns 404 error
• Believing it shows permission denied instead of redirect

4. Identify the error in this Django view using @login_required:

from django.contrib.auth.decorators import login_required
from django.http import HttpResponse

@login_required()
def dashboard(request):
    return HttpResponse('Dashboard')

medium

A. Missing import for HttpResponse

B. Missing request parameter in function

C. Function name should be capitalized

D. Incorrect use of parentheses after @login_required

Solution

1. Step 1: Check the decorator usage syntax

   @login_required is used without parentheses unless passing arguments.

2. Step 2: Identify the incorrect parentheses usage

   Incorrect use of parentheses after @login_required points out the error of using @login_required() instead of @login_required.

3. Final Answer:

   Incorrect use of parentheses after @login_required -> Option D

4. Quick Check:

   Decorator without args has no () = B [OK]

Hint: Use @login_required without () unless arguments needed [OK]

Common Mistakes:

• Adding parentheses when not required
• Forgetting to import HttpResponse (not tested here)
• Changing function name case unnecessarily

5. You want to protect a class-based view DashboardView so only logged-in users can access it. Which is the correct way to apply login_required?

hard

A. Call login_required inside the dispatch method manually

B. Add @login_required above the class definition

C. Use LoginRequiredMixin as a parent class instead of login_required

D. Wrap the class with login_required(DashboardView) after defining it

Solution

1. Step 1: Recall how to protect class-based views in Django

   For class-based views, Django provides LoginRequiredMixin to enforce login.

2. Step 2: Evaluate the options for class-based view protection

   Use LoginRequiredMixin as a parent class instead of login_required correctly uses LoginRequiredMixin as a parent class, which is the standard pattern.

3. Final Answer:

   Use LoginRequiredMixin as a parent class instead of login_required -> Option C

4. Quick Check:

   Class views use mixins, not decorators = A [OK]

Hint: Use LoginRequiredMixin for class views, not @login_required [OK]

Common Mistakes:

• Trying to decorate class directly with @login_required
• Wrapping class after definition with login_required
• Manually calling login_required inside methods