The login_required Decorator

Protecting a View

@login_required checks request.user.is_authenticated before running the view body, redirecting anonymous users instead.

Example: Protecting a View

If the visitor isn't logged in, Django redirects them to LOGIN_URL before dashboard() ever runs.

from django.contrib.auth.decorators import login_required
from django.shortcuts import render

@login_required
def dashboard(request):
    return render(request, 'dashboard.html')

Setting LOGIN_URL

LOGIN_URL tells Django where to send anonymous users who hit a protected view.

Warning: Without LOGIN_URL, Django defaults to /accounts/login/, which may not exist in your project.

Example: Setting LOGIN_URL

Setting this to the URL name login means Django resolves it to wherever that named URL actually points.

LOGIN_URL = 'login'

Returning After Login

Django appends ?next=/dashboard/ to the login redirect so the login view can send the user back afterward.

Example: Returning After Login

Reading next from the submitted form sends the user back to the page they originally tried to visit.

from django.contrib.auth import authenticate, login
from django.shortcuts import redirect, render

def login_view(request):
    if request.method == 'POST':
        user = authenticate(
            request, username=request.POST['username'],
            password=request.POST['password'],
        )
        if user:
            login(request, user)
            return redirect(request.POST.get('next', 'home'))
    return render(request, 'login.html')