Unit-3 - Integrating Accounts & Authentication On Django
Unit-3 - Integrating Accounts & Authentication On Django
Unit: III
Priya Singh
Course Details
(Asst. Professor)
(B. Tech. 5th Sem)
CSE Department
05/19/2024 Priya Singh Python web development with Django Unit III 1
Faculty Introduction
05/19/2024 Priya Singh Python web development with Django Unit III 2
Evaluation Scheme
05/19/2024 4
Priya Singh Python web development with Django Unit III
Syllabus
05/19/2024 Priya Singh Python web development with Django Unit III 5
Syllabus
05/19/2024 Priya Singh Python web development with Django Unit III 6
Syllabus
05/19/2024 Priya Singh Python web development with Django Unit III 7
Syllabus
05/19/2024 Priya Singh Python web development with Django Unit III 8
Branch Wise Application
05/19/2024 Priya Singh Python web development with Django Unit III 9
Course Objective
Analyzing and creating a functional website in Django and deploy Django Web
Application on Cloud.
05/19/2024 Priya Singh Python web development with Django Unit III 10
Course Outcomes (COs)
CO2 : Demonstrate web application framework (Django) to design and implement dynamic website
CO3 : Implementing and analyzing the concept of Integrating Accounts & Authentication on Django
CO4 : Understand the impact of web designing by database connectivity with SQLite
CO5 : Analyzing & Creating a functional website in Django and deploy Django Web Application Cloud
05/19/2024 Priya Singh Python web development with Django Unit III 11
Program Outcomes (POs)
PO8 : Ethics
PO10 : Communication
CO.K PO1 PO2 PO3 PO4 PO5 PO6 PO7 PO8 PO9 PO10 PO11 PO12
CO1 2 2 2 3 3 - - - - - - -
CO2 3 2 3 2 3 - - - - - - -
CO3 3 2 3 2 3 - - - - - - -
CO4 3 2 3 2 3 - - - - - - -
CO5 3 2 3 3 3 - - - - - - -
05/19/2024 Priya Singh Python web development with Django Unit III 14
Program Specific Outcomes(PSOs)
Program Specific
S. No. PSO Description
Outcomes (PSO)
05/19/2024 Priya Singh Python web development with Django Unit III 15
COs - PSOs Mapping
CO1 3 - - -
CO2 3 3 - -
CO3 3 3 - -
CO4 3 3 - -
CO5 3 3 - -
05/19/2024 Priya Singh Python web development with Django Unit III 16
Program Educational Objectives (PEOs)
Program Educational
PEOs Description
Objectives (PEOs)
To have an excellent scientific and engineering breadth so as to comprehend,
PEOs analyze, design and provide sustainable solutions for real-life problems using state-
of-the-art technologies.
To have life-long learning for up-skilling and re-skilling for successful professional
PEOs career as engineer, scientist, entrepreneur and bureaucrat for betterment of society.
05/19/2024 Priya Singh Python web development with Django Unit III 17
Result Analysis(Department Result & Subject Result & Individual result
05/19/2024 Priya Singh Python web development with Django Unit III 18
Pattern of Online External Exam Question Paper (100 marks)
05/19/2024 Priya Singh Python web development with Django Unit III 19
Pattern of Online External Exam Question Paper (100 marks)
05/19/2024 Priya Singh Python web development with Django Unit III 20
Pattern of Online External Exam Question Paper (100 marks)
05/19/2024 Priya Singh Python web development with Django Unit III 21
Pattern of Online External Exam Question Paper (100 marks)
05/19/2024 Priya Singh Python web development with Django Unit III 22
Pattern of Online External Exam Question Paper (100 marks)
05/19/2024 Priya Singh Python web development with Django Unit III 23
Prerequisite / Recap
05/19/2024 Priya Singh Python web development with Django Unit III 24
Brief Introduction about the Subject with videos
• https://youtu.be/tA42nHmmEKw?list=PLh2mXjKcTPSACrQxPM2_1Ojus5HX88ht7
• https://youtu.be/8ndsDXohLMQ?list=PLDsnL5pk7-N_9oy2RN4A65Z-PEnvtc7rf
• https://youtu.be/QXeEoD0pB3E?list=PLsyeobzWxl7poL9JTVyndKe62ieoN-MZ3
• https://youtu.be/9MmC_uGjBsM?list=PL3pGy4HtqwD02GVgM96-V0sq4_DSinqvf
05/19/2024 Priya Singh Python web development with Django Unit III 25
Unit III Content
05/19/2024 Priya Singh Python web development with Django Unit III 26
Unit III Objective
05/19/2024 Priya Singh Python web development with Django Unit III 27
Topic Objective
• In this topic, the students will gain to giving users the ability to
create an account they can sign into is a common function for many
websites.
05/19/2024 Priya Singh Python web development with Django Unit III 28
Django authentication system
• The Django authentication system handles both authentication and
authorization. Briefly, authentication verifies a user is who they claim to be, and
authorization determines what an authenticated user is allowed to do.
The auth system consists of:
• Users
• Permissions: Binary (yes/no) flags designating whether a user may perform a
certain task.
• Groups: A generic way of applying labels and permissions to more than one
user.
• A configurable password hashing system
• Forms and view tools for logging in users, or restricting content
• A pluggable backend system
05/19/2024 Priya Singh Python web development with Djan 29
go Unit III
Introduction to Django Authentication System
For most websites, the basic entity of authentication is a user. A user is
identified by some unique string, which is almost always an email address
or username.
To prove someone is who they say they are, they must provide a password
when creating an account, and again at any time they want to authenticate
themselves. This should be familiar: you go through this kind of workflow
any time you sign up for a service like Twitter or Netflix.
Django provides a User model for creating and managing users. Django
users have a username and password, but can also optionally have an
email address and a first and last name:
05/19/2024 Priya Singh Python web development with Django Unit III 30
Introduction to Django Authentication System
05/19/2024 Priya Singh Python web development with Django Unit III 31
Authentication support is bundled as a Django contrib module in django.contrib.auth. By default,
the required configuration is already included in the settings.py generated by django-admin
startproject, these consist of two items listed in your INSTALLED_APPS setting:
1.'django.contrib.auth' contains the core of the authentication framework, and its default
models.
2.'django.contrib.contenttypes' is the Django content type system, which allows
permissions to be associated with models you create.
05/19/2024 Priya Singh Python web development with Django Unit III 33
Introduction to Django Authentication System
Django can authenticate a user by checking a supplied set of credentials
against the existing set of registered users. If a user matches, Django
will return that user object. Otherwise, it will return None.
When session details are stored in the cache, root namespacing is used
for both session identifiers and application-data keys. This can allow
remote attackers to modify a session by triggering use of a key that is
equal to that session's identifier.
05/19/2024 Priya Singh Python web development with Django Unit III 36
Security Problem & Solution with Django
Django’s Top 10 Vulnerabilities
Versions 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 .
Versions 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5
Cache poisoning occurs when incorrect data is inserted into a DNS resolver
‘s cache, causing the nameserver to provide an incorrect IP address or
destination. These versions of Django do not not properly include the:
1. Vary: Cookie
2. Cache-Control header in response
This can allow remote attackers to obtain sensitive information or poison
the cache via a request from certain
Priya Singh
browsers.
Python web development with Django Unit III
05/19/2024 38
Security Problem & Solution with Django
05/19/2024 Priya Singh Python web development with Django Unit III 39
Security Problem & Solution with Django
Django’s Top 10 Vulnerabilities
05/19/2024 Priya Singh Python web development with Django Unit III 41
Security Problem & Solution with Django
Django’s Top 10 Vulnerabilities
In these versions of Django, remote attackers are able to read or execute files via a /
(slash) character in a key in a session cookie, related to session replays.
3. DoS: Via Unspecified Vectors (CVE-2015-5145)
Versions 1.8.x before 1.8.3
DoS is short for Denial of Service, and occurs when an attacker brings down a
network/website by flooding it with data packets. The validators.URLValidator in these
versions of Django allow remote attackers to cause a denial of service (CPU
consumption) via unspecified vectors.
05/19/2024 Priya Singh Python web development with Django Unit III 42
Security Problem & Solution with Django
V
ersions before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x
before 1.8.3
05/19/2024 Priya Singh Python web development with Django Unit III 43
Security Problem & Solution with Django
Django’s Top 10 Vulnerabilities
Remediation of Django
To fix the above vulnerabilities, you'll need to update the current working
version of your Django framework in all your environments. And while
Django is backwards compatible, it is nonetheless crucial that you identify
any components in your web app that might be impacted by
patching/updating.
UpGuard provides a way for you to do this easily and automatically with a
few mouse clicks. Our powerful policy engine can validate secure
configurations for all environments, infrastructures, and application stacks. In
this case, a simple Django security policy can be run to check for any of the
above vulnerabilities—as well as new vulnerabilities not yet added to policy.
Our OVAL-backed vulnerability detection and monitoring suite ensures that
all your Django components are free for vulnerabilities and security gaps.
05/19/2024 Priya Singh Python web development with Django Unit III 45
Creating Registration Form using Django
User registration
“ As you may have seen, Django comes with a built-in user registration form. We
just need to configure it to our needs (i.e. collect an email address upon
registration).”
Create the register form
05/19/2024 Priya Singh Python web development with Django Unit III 47
Creating Registration Form using Django
This new file is created in the same directory as models.py and views.py.
Then call UserCreationForm within a new class called NewUserForm and add
another field called email. Save the email to the user.Add more fields as needed
to the UserCreationForm.
05/19/2024 Priya Singh Python web development with Django Unit III 48
Creating Registration Form using Django
Add a register URL to the app
05/19/2024 Priya Singh Python web development with Django Unit III 49
Creating Registration Form using Django
05/19/2024 Priya Singh Python web development with Django Unit III 50
Creating Registration Form using Django
Add a register function to the views
05/19/2024 Priya Singh Python web development with Django Unit III 51
Creating Registration Form using Django
05/19/2024 Priya Singh Python web development with Django Unit III 52
Adding Email ,Configuring email & Sending emails with Django
Sending email using Django is pretty easy and require less configuration. In
this lecture, we will send email to provided email.
For this purpose, we will use Google's SMTP and a Gmail account to set
sender.
Django provides built-in mail library django.core.mail to send email.
Before sending email, we need to make some changes in Gmail account
because for security reasons Google does not allow direct access (login) by
any application. So, login to the Gmail account and follow the urls. It will
redirect to the Gmail account settings where we need to allow less secure
apps but toggle the button. See the below screenshot.
05/19/2024 Priya Singh Python web development with Django Unit III 53
Adding Email ,Configuring email & Sending emails with Django
05/19/2024 Priya Singh Python web development with Django Unit III 54
Adding Email ,Configuring email & Sending emails with Django
05/19/2024 Priya Singh Python web development with Django Unit III 55
Adding Email ,Configuring email & Sending emails with Django
05/19/2024 Priya Singh Python web development with Django Unit III 56
Adding Email ,Configuring email & Sending emails with Django
05/19/2024 Priya Singh Python web development with Django Unit III 57
Adding Email ,Configuring email & Sending emails with Django
05/19/2024 Priya Singh Python web development with Django Unit III 58
Adding Grid Layout On Registration Page
05/19/2024 Priya Singh Python web development with Django Unit III 59
Adding Grid Layout On Registration Page
Bootstrap Container
A Container is the outermost component the Bootstrap framework knows of. Here
the designer can specify the breakpoints of a web page. By default, Bootstrap
offers 4 breakpoints: “large”, “medium”, “small” and “tiny”. These determine for
which kind of screen widths, the grid system may switch the layout.
The editor window for a Container element offers the possibility to deactivate
certain breakpoints. While this might make sense under certain conditions, it is
safe to always keep all four breakpoints active, since this gives the designer of the
web page the maximum flexibility.
05/19/2024 Priya Singh Python web development with Django Unit III 60
Adding Grid Layout On Registration Page
Small devices exclusively :-
05/19/2024 Priya Singh Python web development with Django Unit III 61
Adding Page Restrictions
Creating a website is fun, but a login restrictor in your website will make it look more
secure. Django REST Framework is a robust and flexible toolkit for building Web APIs.
The Django login required decorator provide the feature to restrict the access
We have often visited websites in which we need to log in first before accessing or
visiting other pages. In other words, restricting access.
05/19/2024 Priya Singh Python web development with Django Unit III 62
Adding Page Restrictions
We also came across some of our projects where we need to do the same
but wonder how? So yes you came to the right place, but before moving
ahead let’s first sneak peek about the login decorator in Django Rest
Framework. login_required() decorator does the following things:-
Execute normally the view if the user is logged in.
Redirect the user to the login_url path if the user is not logged in.
Syntax:-
@login_required(login_url=”html page”)
In this lecture , we will understand how to restrict access with the Django
login required decorator function? Where to use it? And all about it.
05/19/2024 Priya Singh Python web development with Django Unit III 63
Why Decorators?
Django provides several decorators that can be applied to views to support various HTTP features .
Decorators are an easy way to clean up your code and separate the view
authentication process from the view functionality. Django has several useful built-
in decorators such as @login_required, @permission_required for user permissions
and @require_http_methods for restricting request methods (GET|POST).
Exaplaining Django Login and Logout. Django is a High-Level Web Framework and it has
lots of built-in features. We can use those built-in functions for our common use of Web
Application. Some of the functions are Permission and User Control, Signals, Templates,
Django ORM, Access Control List, etc. Out of this Registration App, is a good example and
a good thing about it is that the features can be used out-of-the-box.
With the Authentication Views, you can take advantage of the following features
1. Login
2. logout
3. User Registration
4. Change Password
5. Reset Password or Forgot Password
05/19/2024 Priya Singh Python web development with Django Unit III 65
Login Functionality Test and Logout
05/19/2024 Priya Singh Python web development with Django Unit III 66
Login Functionality Test and Logout
05/19/2024 Priya Singh Python web development with Django Unit III 67
Login Functionality Test and Logout
05/19/2024 Priya Singh Python web development with Django Unit III 68
Daily Quiz
05/19/2024 Priya Singh Python web development with Django Unit III 70
Topic Link ( YouTube & NPTEL Video Links)
• https://youtu.be/tA42nHmmEKw?list=PLh2mXjKcTPSACrQxPM2_1Ojus5HX88ht7
• https://youtu.be/8ndsDXohLMQ?list=PLDsnL5pk7-N_9oy2RN4A65Z-PEnvtc7rf
• https://youtu.be/QXeEoD0pB3E?list=PLsyeobzWxl7poL9JTVyndKe62ieoN-MZ3
• https://youtu.be/9MmC_uGjBsM?list=PL3pGy4HtqwD02GVgM96-V0sq4_DSinqvf
05/19/2024 Priya Singh Python web development with Django Unit III 71
MCQ s
1. What is a Django App? 2. Django was introduced by
ADjango app is an extended package with base package
is Django A. Adrian Holovaty
B. Django app is a python package with its own B. Bill Gates
components. C. Rasmus Lerdorf
C. Both 1 & 2 Option D. Tim Berners-Lee
D. All of the above
3. What are Migrations in Django
A. They are files saved in migrations directory.
B. They are created when you run make migrations
command.
C. Migrations are files where Django stores changes to
your models.
D. All of the above
8. What is the OUTPUT of the following Statement? 9. What is the OUTPUT when the following
print 0xA + 0xB + 0xC : Statement is executed?
0xA0xB0xC “abc”+”xyz”
33 abc
ABC abcxyz
000XXXABC abcz
abcxy
05/19/2024 Priya Singh Python web development with Django Unit III 77
References
(1) Tom Aratyn, “Building Django 2.0 Web Applications: Create enterprise-grade, scalable
Python web applications easily with Django 2.0”, 2nd Edition 2018, Packt Publishing.
(2) Nigel George, “Build a website with Django”, 1st Edition 2019, GNW Independent
Publishing Edition.
(3) Ray Yao,” Django in 8 Hours: For Beginners, Learn Coding Fast!, 2nd Edition 2020,
Independently published Edition.
(4) Harry Percival, “Test-Driven Development with Python: Obey the Testing Goat: Using
Django, Selenium, and JavaScript”, 2nd Edition 2019, Kindle Edition.
05/19/2024 Priya Singh Python web development with Django Unit III 78
THANK YOU
05/19/2024 Priya Singh Python web development with Django Unit III 79