Implementing authorization
We have implemented authentication where we allow users to sign up and log in. But we also need authorization that authorizes access to certain pages only to logged-in users.
Currently, if a user manually enters the URL to create a review – for example, http://localhost:8000/movie/2/create – they can still access the form. We should authorize access to creating/updating/deleting reviews only to logged-in users. We will also authorize access to logout.
Let's look at the steps to do so:
- We import and add the
@login_requireddecorator to the views that we want to authorize, as shown in bold:
/movie/views.py
… from .forms import ReviewForm from django.contrib.auth.decorators import login_required … @login_required def createreview(request, movie_id): … @login_required def updatereview(request, review_id): … @login_required def deletereview...