Set your Publisher ID in src/config/ads.ts to display live ads.
Authentication, Authorization & Security Best Practices
The built-in User model, login decorators, and production hardening
Django was engineered from the ground up to prevent common security oversights automatically, protecting applications from SQL injection, Cross-Site Scripting, and clickjacking.
User Authentication and Access Guards
django.contrib.auth: Built-in user authentication system providing password hashing with PBKDF2/SHA256, groups, and fine-grained permissions.
@login_required: Decorator that protects view functions from unauthenticated access, automatically redirecting guests to the login URL.
Production security checklist: Set DEBUG = False, enable SECURE_SSL_REDIRECT = True, configure SESSION_COOKIE_SECURE = True, and restrict ALLOWED_HOSTS.
from django.contrib.auth.decorators import login_required
from django.shortcuts import render, redirect
from django.core.exceptions import PermissionDenied
from .models import Course
@login_required(login_url='/accounts/login/')
def student_dashboard(request):
# Only show courses enrolled by the active user
enrolled_courses = request.user.enrollments.select_related('course')
return render(request, 'dashboard/index.html', {
'user': request.user,
'enrollments': enrolled_courses
})
@login_required
def delete_course(request, pk):
course = Course.objects.get(pk=pk)
if course.instructor != request.user and not request.user.is_superuser:
raise PermissionDenied("You are not authorized to modify this course.")
course.delete()
return redirect('course_list')Set your Publisher ID in src/config/ads.ts to display live ads.
Test Yourself With Exercise
Which setting MUST ALWAYS be set to False before deploying a Django application to a public production server?