A user account is a stored identity record for someone who can access a system. In Django, the ORM tracks accounts, while authentication proves identity and authorization controls permitted actions. A reader may view articles, for example, while a journalist may edit them. section 1.1.4 section 6.1
A working account system usually combines:
- An ORM-backed user model that stores login details and validates passwords; Django handles password encryption. section 6.1
- Middleware and sessions that remember whether a user is logged in between requests. section 6.1
- Authorization checks, such as @login_required, followed by view-specific permission logic. section 6.1 section 6.8
- Management features for sign-up, administration, blocking accounts, and password resets. section 1.1.4 section 6.8
A protected page
A request reaches a URL, passes through session middleware, and calls a view protected by @login_required. Anonymous visitors are redirected to the login page; authenticated visitors can continue, after which the view may check whether their account belongs to the relevant band. Extra profile data can live in a related profile object or a custom User object. section 6.1 section 6.8
Figure 6.1 Session management and login control through middleware
Follow the request path from session management through middleware to login control and the protected view. section 6.1
