Django Authentication 6.0

Last reviewed Sep 20, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. Python 3155 lines · 3.8K tokens
  2. Django 6.0110 lines · 4.1K tokens
  3. Django Authentication 6.073 lines · 3.5K tokens
Total338 lines · 11.4K tokens

CWE Coverage

  • 20
  • 23
  • 36
  • 59
  • 73
  • 78
  • 79
  • 89
  • 95
  • 117
  • 201
  • 203
  • 208
  • 209
  • 214
  • 250
  • 287
  • 288
  • 295
  • 307
  • 319
  • 328
  • 338
  • 347
  • 352
  • 362
  • 367
  • 379
  • 384
  • 409
  • 416
  • 426
  • 427
  • 434
  • 470
  • 502
  • 521
  • 524
  • 532
  • 601
  • 611
  • 613
  • 614
  • 620
  • 639
  • 640
  • 674
  • 732
  • 770
  • 772
  • 776
  • 778
  • 798
  • 807
  • 829
  • 841
  • 862
  • 863
  • 915
  • 916
  • 918
  • 942
  • 1004
  • 1021
  • 1104
  • 1275
  • 1333
  • 1336
  • 1395

Prompt Preview

Apply the Django 6.0 prompt first. These rules cover django.contrib.auth in Django 6.0.8 on Python 3.12–3.14, including custom backends, password recovery, authenticated session lifecycle, remote-user authentication, and permission administration. Apply separate guidance for the actual MFA, OAuth/OIDC, or API-token implementation when one is installed.

Identity and authentication backends

  • Treat AUTHENTICATION_BACKENDS ordering as security policy: authentication stops at the first successful backend. Do not add a local-password fallback that bypasses required external authentication, and invalidate existing sessions when a policy change must force reauthentication; Django reuses the backend path stored in each session.
  • Enforce account eligibility in custom get_user() and aget_user() implementations as well as credential authentication. login() does not check is_active, and neither login_required nor LoginRequiredMixin supplies that check; an AllowAllUsers*Backend intentionally bypasses the built-in inactive-user restriction.
  • Keep the backend argument to login() and user.backend under server control. Select a configured backend that actually verified the identity; never copy its dotted import path from request data.
  • Use get_user_model() and settings.AUTH_USER_MODEL for user lookups and relations. Give USERNAME_FIELD a database-enforced unique identity when using ModelBackend; a nonunique identifier requires a custom backend that unambiguously resolves the account within a trusted scope.
  • Preserve