Setting Up a Login View

A login view is like a bouncer that checks your username and password before letting you into the party.

In this page:

Writing the Login View
The Login Template
Wiring the URL

Writing the Login View

A login view reads the submitted username/password, calls authenticate() to verify them, and calls login() to start the session.

Note: authenticate() returns None for wrong credentials — always check before calling login().

Example: Writing the Login View

authenticate() safely checks the hashed password; login() then stores the user id in the session.

markup

from django.contrib.auth import authenticate, login
from django.shortcuts import render, redirect

def login_view(request):
    if request.method == 'POST':
        username = request.POST['username']
        password = request.POST['password']
        user = authenticate(request, username=username, password=password)
        if user is not None:
            login(request, user)
            return redirect('home')
    return render(request, 'login.html')

{# Django-only code -- models.py/views.py/urls.py/settings.py snippets, or template markup using Django template tags/variables -- can't run standalone via Judge0 or the browser preview, since it needs a real Django project. Only this course's pure-Python examples (example_lang == 'python', no Django imports) are actually runnable, so those still get the button below. #}

The Login Template

The login form posts username and password fields back to the same view, with a CSRF token for protection.

Example: The Login Template

Each input has a matching label and a name attribute so Django's request.POST can read username and password.

markup

<form method="post">
  {% csrf_token %}
  <label for="username">Username</label>
  <input type="text" id="username" name="username">
  <label for="password">Password</label>
  <input type="password" id="password" name="password">
  <button type="submit">Log In</button>
</form>

Wiring the URL

The login view needs a URL entry so the browser can reach /login/.

Example: Wiring the URL

Naming the URL login lets templates link to it with {% url login %} instead of a hardcoded path.

markup

from django.urls import path
from . import views

urlpatterns = [
    path('login/', views.login_view, name='login'),
]

Common Mistakes

Forgetting {% csrf_token %} in the login form template, which makes Django reject the POST request.
Comparing raw passwords manually instead of calling authenticate(), which correctly checks the hashed password.
Not redirecting after a successful login, letting the browser resubmit the login form if the user refreshes.

Chapter Summary

authenticate() checks a username/password pair and returns a User or None.
login() attaches that user to the current session so they stay logged in across requests.
Always redirect after a successful POST login to avoid resubmission on refresh.
Login templates must include {% csrf_token %} inside the <form> tag.

🔒

Chapter Quiz — Complete all 12 topics to unlock

0/12 topics done

Complete these topics first:

← Previous Lesson The User Model Overview Next Lesson → Logout Functionality

Setting Up a Login View

Writing the Login View

The Login Template

Wiring the URL

Chapter Quiz — Complete all 12 topics to unlock

Login to run this code