Why authorization matters in Django - Visual Breakdown

Concept Flow - Why authorization matters

User sends request

↓

Authentication: Who is user?

↓

Authorization: What can user do?

↓

Allowed

↓

Access granted

↓

Response sent

The flow shows how a user request is first checked for identity (authentication), then checked for permissions (authorization), leading to access granted or denied.

Execution Sample

Django

from django.shortcuts import redirect
from django.http import HttpResponse

def view(request):
    if not request.user.is_authenticated:
        return redirect('login')
    if not request.user.has_perm('app.view_data'):
        return HttpResponse('Access denied')
    return HttpResponse('Data shown')

This Django view checks if the user is logged in and has permission before showing data.

Execution Table

Step	Check	Condition	Result	Action
1	Is user authenticated?	False	No	Redirect to login page
2	Is user authenticated?	True	Yes	Check permission
3	Does user have 'app.view_data' permission?	False	No	Return 'Access denied' response
4	Does user have 'app.view_data' permission?	True	Yes	Return 'Data shown' response

💡 Execution stops when user is either redirected or response is returned based on authentication and authorization checks.

Variable Tracker

Variable	Start	After Step 1	After Step 3	Final
request.user.is_authenticated	Unknown	False or True	True if passed step 1	True if passed step 3
request.user.has_perm('app.view_data')	Unknown	Not checked	False or True	True if passed step 3

Key Moments - 2 Insights

Why do we check authentication before authorization?

Because authorization depends on knowing who the user is. The execution_table shows authentication checked first at step 1 before permission check at step 3.

What happens if a user is not authorized?

The code returns an 'Access denied' response as shown in step 3 of the execution_table, stopping further access.

Visual Quiz - 3 Questions

Look at the execution_table, what happens if request.user.is_authenticated is False?

A User gets 'Access denied' message

B User is redirected to login page

C User is shown data

D Nothing happens

💡 Hint

See step 1 in execution_table where authentication is False

At which step does the code check if the user has permission 'app.view_data'?

A Step 3

B Step 2

C Step 1

D Step 4

💡 Hint

Check the 'Check' column in execution_table for permission check

If the user is authenticated but lacks permission, what is the final action?

A Redirect to login

B Return 'Data shown' response

C Return 'Access denied' response

D Raise an error

💡 Hint

See step 3 in execution_table where permission is False

Concept Snapshot

Authorization controls what an authenticated user can do.
Always check authentication first, then authorization.
Deny access if permission is missing.
Protects sensitive data and actions.
In Django, use user.has_perm() to check permissions.

Full Transcript

This visual execution shows why authorization matters in Django. When a user sends a request, the system first checks if the user is authenticated, meaning logged in. If not, the user is redirected to the login page. If authenticated, the system then checks if the user has the required permission to view data. If the user lacks permission, access is denied with a message. Only if both checks pass does the system show the data. This flow protects resources by ensuring only allowed users can access them. The execution table traces these checks step-by-step, and the variable tracker shows how user authentication and permission states change during execution.