Security: bypassing login with URL entry

user_10850628 0
Viewed 486

I’m looking to create a login system for my Django web application, which is connected to a MySQL database with a table for managers that holds their name, email, and password. My login screen has a URL of localhost/login. I want to query the off-server database for the username and password for each manager that was entered when the user puts in the information. If the credentials match, then I want to redirect them to the manager page, which is localhost/manager. If they don’t match, then I want to keep them at that page, localhost/login. My question is what’s stopping the user from inputting the localhost/manager URL path into their browser and bypassing the login, getting access without getting authenticated? Is there a good way to store the user name and password in the database to make them more secure but also accessible and checkable again?

authentication security mysql django python
1 Answers

Suppose your manager return from a class-based view. Then use LoginRequireMixin in the first parameter. LIke this.

from django.contrib.auth.mixins import LoginRequiredMixin
class ManagerView(LoginRequireMixin, TemplateView):
   ...

If you are using function-based view, the use this

from django.contrib.auth.decorators import login_required

@login_required
def ManagerView(request):
    ...
user_47517260
Related