Why authorization matters in Django - See It in Action

Why authorization matters

📖 Scenario: You are building a simple Django web app where users can view their own profile information. Authorization ensures that users cannot see or change other users' profiles.

🎯 Goal: Create a Django view that only allows a logged-in user to access their own profile page. If a user tries to access another user's profile, they should be denied.

📋 What You'll Learn

Create a Django model called UserProfile with fields user (OneToOneField to User) and bio (TextField).

Create a view function called profile_view that takes request and username as parameters.

In profile_view, check if the logged-in user's username matches the username parameter to authorize access.

If authorized, render a template called profile.html with the user's profile data; otherwise, return HttpResponseForbidden.

💡 Why This Matters

🌍 Real World

Authorization is essential in web apps to protect user data and privacy by ensuring users only access what they are allowed to.

💼 Career

Understanding authorization is critical for backend developers and full-stack developers to build secure applications.

1

Create the UserProfile model

Create a Django model called UserProfile with a user field as a OneToOneField to auth.User and a bio field as a TextField.

Django

# Define the UserProfile model here
# Your code here

Hint

Use models.OneToOneField to link to the User model and models.TextField for the bio.

2

Add the profile_view function

Create a view function called profile_view that takes request and username as parameters.

Django

from django.db import models
from django.contrib.auth.models import User

class UserProfile(models.Model):
    user = models.OneToOneField(User, on_delete=models.CASCADE)
    bio = models.TextField()

# Define profile_view function here
# Your code here

Hint

Define a function with the exact name profile_view and parameters request, username.

3

Check authorization inside profile_view

Inside profile_view, check if request.user.username equals the username parameter. If not equal, return HttpResponseForbidden(). Otherwise, get the UserProfile for that user.

Django

from django.db import models
from django.contrib.auth.models import User
from django.http import HttpResponseForbidden
from django.shortcuts import render, get_object_or_404

class UserProfile(models.Model):
    user = models.OneToOneField(User, on_delete=models.CASCADE)
    bio = models.TextField()

def profile_view(request, username):
    # Check if logged-in user matches username
    # Your code here

Hint

Use an if statement to compare usernames and return HttpResponseForbidden() if they don't match.

4

Render the profile.html template

In profile_view, after authorization and fetching the profile, render the profile.html template passing the profile object in the context with key profile.

Django

from django.db import models
from django.contrib.auth.models import User
from django.http import HttpResponseForbidden
from django.shortcuts import render, get_object_or_404

class UserProfile(models.Model):
    user = models.OneToOneField(User, on_delete=models.CASCADE)
    bio = models.TextField()

def profile_view(request, username):
    if request.user.username != username:
        return HttpResponseForbidden()
    user = get_object_or_404(User, username=username)
    profile = get_object_or_404(UserProfile, user=user)
    # Render profile.html with profile context
    # Your code here

Hint

Use render to send the profile object to the template named profile.html.

Practice

1. Why is authorization important in a Django web application?

easy

A. It helps in designing the user interface.

B. It speeds up the loading time of the website.

C. It automatically fixes bugs in the code.

D. It controls which users can access certain parts of the app.

Solution

1. Step 1: Understand the role of authorization

   Authorization decides what parts of the app a user can see or use.

2. Step 2: Compare with other options

   Speed, design, and bug fixing are unrelated to authorization.

3. Final Answer:

   It controls which users can access certain parts of the app. -> Option D

4. Quick Check:

   Authorization controls access = C [OK]

Hint: Authorization controls access, not speed or design [OK]

Common Mistakes:

• Confusing authorization with authentication
• Thinking authorization improves performance
• Believing authorization designs UI

2. Which Django decorator is used to require a user to be logged in before accessing a view?

easy

A. @permission_required

B. @login_required

C. @csrf_protect

D. @require_GET

Solution

1. Step 1: Identify the decorator for login requirement

   The decorator @login_required ensures only logged-in users access the view.

2. Step 2: Differentiate from other decorators

   @permission_required checks permissions, @csrf_protect protects against CSRF, and @require_GET limits HTTP methods.

3. Final Answer:

   @login_required -> Option B

4. Quick Check:

   Login check decorator = @login_required [OK]

Hint: Login check uses @login_required decorator [OK]

Common Mistakes:

• Using @permission_required instead of @login_required
• Confusing CSRF protection with authorization
• Mixing HTTP method decorators with authorization

3. Consider this Django view code:

@login_required
def dashboard(request):
    if not request.user.has_perm('app.view_dashboard'):
        return HttpResponse('Access Denied')
    return HttpResponse('Welcome to Dashboard')

What will a logged-in user without the 'app.view_dashboard' permission see?

medium

A. Access Denied

B. Welcome to Dashboard

C. A 404 Not Found error

D. A login page

Solution

1. Step 1: Analyze the permission check

   The code checks if the user has 'app.view_dashboard' permission; if not, it returns 'Access Denied'.

2. Step 2: Consider the user's permission

   The user is logged in but lacks the permission, so the 'Access Denied' response is returned.

3. Final Answer:

   Access Denied -> Option A

4. Quick Check:

   Permission missing shows 'Access Denied' = A [OK]

Hint: No permission means 'Access Denied' message shown [OK]

Common Mistakes:

• Assuming login means full access
• Thinking missing permission causes 404 error
• Confusing permission denial with login redirect

4. What is wrong with this Django view code for enforcing authorization?

def profile(request):
    if not request.user.is_authenticated:
        return HttpResponse('Please log in')
    if not request.user.has_perm('app.view_profile'):
        return HttpResponse('Access Denied')
    return HttpResponse('User Profile')

medium

A. It should use @login_required decorator instead of manual check.

B. The permission check is missing.

C. It returns the wrong HTTP status codes.

D. It does not check if the user is a superuser.

Solution

1. Step 1: Review authentication check method

   The code manually checks if the user is authenticated instead of using the standard @login_required decorator.

2. Step 2: Understand best practice

   Using @login_required is cleaner and automatically redirects unauthenticated users to login.

3. Final Answer:

   It should use @login_required decorator instead of manual check. -> Option A

4. Quick Check:

   Use @login_required for authentication checks [OK]

Hint: Use @login_required decorator, not manual authentication checks [OK]

Common Mistakes:

• Ignoring @login_required decorator
• Assuming manual checks are better
• Missing permission checks

5. You want to restrict access to a Django view so only users with both 'app.view_reports' permission and who are staff can access it. Which code snippet correctly enforces this?

hard

A. @login_required def reports(request): if not request.user.has_perm('app.view_reports'): return HttpResponse('Access Denied') return HttpResponse('Reports Page')

B. @login_required def reports(request): if request.user.is_staff or request.user.has_perm('app.view_reports'): return HttpResponse('Reports Page') return HttpResponse('Access Denied')

C. @permission_required('app.view_reports') def reports(request): if not request.user.is_staff: return HttpResponse('Access Denied') return HttpResponse('Reports Page')

D. @permission_required('app.view_reports') @superuser_required def reports(request): return HttpResponse('Reports Page')

Solution

1. Step 1: Understand the permission and staff checks

   The view must check both permission and staff status before allowing access.

2. Step 2: Analyze each option

   @permission_required('app.view_reports') def reports(request): if not request.user.is_staff: return HttpResponse('Access Denied') return HttpResponse('Reports Page') uses @permission_required to check permission and then manually checks is_staff, denying access if false. This correctly enforces both conditions.

3. Step 3: Why other options fail

   @login_required def reports(request): if not request.user.has_perm('app.view_reports'): return HttpResponse('Access Denied') return HttpResponse('Reports Page') only checks permission but misses staff check; @login_required def reports(request): if request.user.is_staff or request.user.has_perm('app.view_reports'): return HttpResponse('Reports Page') return HttpResponse('Access Denied') uses OR instead of AND; @permission_required('app.view_reports') @superuser_required def reports(request): return HttpResponse('Reports Page') uses @superuser_required which is not a standard Django decorator and will cause a NameError.

4. Final Answer:

   @permission_required('app.view_reports') def reports(request): if not request.user.is_staff: return HttpResponse('Access Denied') return HttpResponse('Reports Page') -> Option C

5. Quick Check:

   @permission_required('app.view_reports') def reports(request): if not request.user.is_staff: return HttpResponse('Access Denied') return HttpResponse('Reports Page') [OK]

Hint: Use @permission_required plus manual staff check for AND condition [OK]

Common Mistakes:

• Using OR instead of AND for permission and staff
• Missing login or permission decorators
• Using non-standard decorators without import