Django Tutorial - Login, Logout and User Authentication

Key Takeaways

Hey guys and welcome back to another Django tutorial. So in today's video, what we'll be doing is talking about logging in and authenticating users. I will also show you how we can only restrict uh pages so that users that are logged in can see them. So for example, we maybe don't want a user that's not logged in to be able to create a new to-do list or because that probably won't work. Uh so how we can do stuff like that. And then in the next video, what we're I'm going to be doing is talking about creating a custom user model, which means that we can add things like all of our to-do lists to a specific user so that each user has their own to-do list. And when they go on the website, they're going to see a different to-do list, not just all of the ones that have been created by any user. That's what we'll be doing the next one, but this one will just be logging in, validating, and logging out as well. So, what we actually need to do first of all when we're going to be logging in and logging out is we need to create those login and logout pages. Now, luckily for us, Django actually does a lot of this work for us. They have a built-in application and if I show you in settings.py here, that is Django. And what this does is it authenticates users. So, we've done all the hard work of creating new users, but now since we've done that, Django can actually authenticate those for us. So, we can use some of the built-in things in this application to do that for us. So, the first step uh and what we want to do is we actually want to use some built-in pages that Django's made. So, they actually have made log out, login, um what is it? Change password, like a ton of different pages like that that we can access uh simply by linking to them in our URL patterns from our main URLs file inside of my site. So, what I'm going to do just like I've done to get into my other applications is I'm just going to say path and in this case include, but in here I'm going to say uh Django. Contrib. URLs. And I believe that's correct, but I will check that quickly to make sure I didn't mess that up. Uh, yes. So, that's correct. So, what this will do now is it'll go to this application. It'll look in the URLs file there, and we'll see if we have a valid URL. So, if we have login, log out, change password, create password, uh, a bunch of those different pages. Right now, we're just going to work with login and log out, but you know what I mean. So, that's what that'll do for us. But the thing is these uh views if we try to go to them now they actually don't exist. So what those templates attempt to do or what the views attempt to do is render a template called login.html logout.html from a specific folder that we need to create. So what we actually need to do and it doesn't really matter where we do this but I'm going to do it from inside of my register application. So, inside of templates, I'm going to create a new folder. And in here, I'm going to call this registration like that. Um, now it's important that you spell registration correctly, like I just misspelled it, registration, because it's going to look for this specific folder. So, we're going to create a registration folder inside one of our templates folder. And then in here, we're going to create a new uh HTML file, and we're going to call this login.html. Now, this is going to be where Django will look. uh and what template it will use to render our login form. So what we'll do is we'll simply just do what we've done before. So we'll start by extends um and then in this case main slashbase.html and then we'll add our blocks for our title and for our content. So let's do that now. Uh block title and then we're going to say end block like that. And then I guess we can do the title. We'll just do login here or something like that. And then, you know, I can just copy this. And we'll just change the name to content. And now we're just going to create a nice form in here that will display our form just like we've done probably four or five times by now. So we'll say form. We're going to say method equals in this case post. And then we're going to say class equals in this case form group. Now we can end our form like that. And then inside of here, we'll add our CSFR token or whatever that is. CSRF token. And we will simply display our form. Now, I want to add this to be a crispy form so it looks a bit nicer. So to do that, we'll have to load in our crispy tags. So we'll say load, and in this case, crispy_formms tags. I believe that's the correct way to do that. If you don't have crispy forms installed, go back and watch the last video because we did that there. And then what we'll do is we'll add a filter here and we'll say as the filter, we'll just say crispy. And this will display a nice form for us. Now, we also need to add a button into our form because that doesn't come with it. So to do that, we'll say button. We'll say type equals, in this case, submit. And then I guess we'll say class equals btn btny-en success and end our button and just say login as the name. Sweet. So that should be it for this login form. Now we actually may want to add one more thing because sometimes you go to a login page it says well rather than logging in like create an account if you don't have one. So maybe we'll add that in here quickly just make things look a bit nicer. So, we'll just add, I guess, some P tags. And I'll just say /p. And I'm going to say don't have an account question mark create one. And then I'll add an a tag, which will just link to our create. So, I believe it was slashregister. We did. Was it slregister slashcreate? That was that URL. Let's check inside of where is it? Here. Uh, register. Register is the name. Awesome. So let's go back here, register, and we'll say here, and then slash a. Sweet. So that should actually be it for the login page. And now we can actually go ahead and run our server, which I already have running. And we will see that the login page is actually working. So this is the logout page. Let's go to login and see what we get. /lo. Um. Oh. Well, if you spell extends incorrectly, extends. There you go. Then it won't work. Now, let's try it. If I refresh this here, there we go. So now you can see that we actually have a nice login page. And this took us all of what uh 6 minutes to create. So it's pretty straightforward. And what will actually happen here is this will properly do our login and validate users for us. So let's try to log in. This is a valid login right now. Password 1 2 3 4. When I click login, you can see that uh it's actually directing me back to the homepage. Now, the reason that this is happening is because uh I actually have something added down here in my settings.py file that I forgot to like resave. Um that was telling us to redirect to that page. But let me just refresh this. Let me go back to login and do this again because I want to show you what happens if you don't have that. Uh you could see that it brings us to this no page not found which is probably what you guys were getting when you're running this. Now, that's because what happens is when we try to log in, it's going to automatically attempt to redirect us to a page called accounts/profile. Now, we obviously haven't created a page or a URL for accounts/profile. So, what we need to do is we need to modify where we're going to go once we log in. Now, the reason it was happening for me is cuz I I had done that previously and forgot to save removing it. But, let's go inside our settings.py Pi file inside of our my site and let's add a redirect to let's say the homepage whenever we log in. So to do this I'm going to say in this case log in redirect URL equals and in this case you can pick wherever you'd like to go but I'm just going to do slash uh standing for obviously the homepage. So let's do that. Now let's rerun and try to log in. And well, we will see that we should be directed directly to the homepage once we log in. Let's do that. And you can see we are brought to the homepage. So that's awesome. Now I'm just going to quickly move this up uh one because I don't like how that looks. Let's put this P tag just above here. And now I want to refresh this. And that looks a little bit better to me. So sweet. That's how we log in. Now let me show you what's actually happening in the back end when or how we can validate if we're logged in or not. because right now there's not really any way for us to tell whether or not we're logged in or we're logged out. So what I'm going to do is I'm going to go actually all the way back into my main application into templates and base.html and I'm going to create a thing that essentially only shows our main content uh body. So like this block content if we are logged in otherwise it will tell us to log in and it'll leave a link that says login. So, a way that you can actually tell if a user is logged in or not is by using what's known as user.isauthenticated. So, I can actually create a code block here. And I'm going to make this an if statement. I'm going to say if user is_authenticated authenticated, I think I spelled that correctly. So what this does is by default whenever you go to a web page in Django it has a user attribute which stands for the current user. Now if there's no user um signed in I believe it defaults to what's known as an anonymous user. So if you call user is authenticated on the user if it is a valid user that's properly signed into the web page then this will return true. If it does not return true then the person is not signed in. So essentially, I only want to show this content block for all the different pages that I have if we're logged in. Otherwise, I want to ask the user to log in or even maybe redirect them to login. So what I'll do here is now I'm going to put an else statement uh that'll say essentially else. So if you're not logged in, what we'll do is we'll literally just put an a tag. And you you guys could obviously make this look a lot nicer than I'm going to do. And we'll just link it to the login page. and we'll say uh log in here. And you can just click this whole thing and that'll you know what? Actually, let's put this in a p tag. Make it look a little bit nicer. slashp and instead of having the whole thing be a link, we'll just do login here. All right. So now we will hopefully redirect to the login page. And then last thing I need to do before I forget is just end this if block. So we'll say end if. And there we go. So, let's now go back and let me go to home. And I don't think I'm currently logged in, but we'll see. And okay, so it is I am currently logged in. So, what I want to do actually is just log out. So, log out brings us to this logout page, right? That just says thank you for logging out. This is the default logout page. I'm going to show you. We can change that in just a second. So, now let's go back to the web page and let's just go to the homepage. And you can see that now that I'm not logged in, it says log in here. If I click this, um, oh, okay. So, that is actually an issue. So, what's happening essentially is when I go to the login page, since we're not logged in, it's not showing the login page cuz that's the block content. Uh, so this is probably not the best way to do it, but this is how you can tell if someone is authenticated. So, maybe actually let me remove this. Um, yeah, because it won't let us log in if that is there. So let we'll remove this for now and just leave it as blog content. But that shows you guys how you can restrict kind of page access to people that are logged in. So obviously on certain pages you might want to add that if statement so that it's showing different stuff based on if you're logged in or if you're not logged in. But that is essentially kind of how you do log and log out. I'll really quickly show you how to change the logout page if you'd like to do that. So same thing as kind of changing the redirect here for login. So all we'll do is we'll just literally copy this and change this to log out uh_redirect. URL and then here we can just define whatever page we want to go to when we log out. So if you had created a logout template, you could go to that. You could go to essentially whatever you want just by doing that. I'll just leave it as a homepage for now. Uh but you know, you get the idea. So I guess the last thing I'll show you is let's say that you create some URLs inside of your new application. So maybe we go we have a URL and we have to create. So let's go to the create page for a second. Uh actually I want to go to views. My apologies. If we want to get the user from with within code, we don't want it just inside of the HTML file. What we can actually do is we can type response.user. Now when you do response do user that will give you the user and you can run is authenticated. you can get all the attributes of the user like the name, the password, the email, all that stuff directly from the code and then obviously you could pass that into uh the context of the page or you could do whatever you need to do with it from the back end. So I figured I'd show you how to do that quickly. So anyways, that has kind of been it for logging in and logging out. Pretty straightforward. In the next video, we'll create a custom user model and we'll talk about how we can modify that model to add attributes like all the to-do list to a specific user. So anyways, that has been it for this video. I hope you guys enjoyed. If you did, please make sure you leave a like and subscribe and I will see you again in the next one. [Music]