What Comes Built In

Already there before you write anything. A User model, password hashing, login, logout, sessions, password reset, and a permissions system.

That is a significant amount of security-critical code you are not writing, which is the point. Every one of those has a correct implementation and a dozen subtly wrong ones.

Never store a password yourself. Django hashes them with a deliberately slow algorithm, salts each one, and can upgrade the algorithm as standards move, re-hashing on next login. Storing a password in any recoverable form is a mistake you cannot undo later, because the damage is done the moment the database leaks.

If you find yourself writing code that compares a password to a stored string, stop.

Sessions, in one paragraph. HTTP forgets everything between requests. A session is a record on the server plus a cookie holding its id, so the next request can be recognized as the same person.

request.user is always present: either a real User or an AnonymousUser. That is why templates can write {% if user.is_authenticated %} without anything being passed in.

✦ The next parameter is a small kindness

login_required sends someone to the login page with ?next= carrying where they were going, and Django returns them there afterwards. It costs nothing and it is the difference between signing in and continuing, and signing in and having to find your way back.