Python kursi/Django11/16-dars15 daqiqa

Mundarija (22)

21.11-dars: Autentifikatsiya tizimi

21-QISM — DJANGO · 11-dars

1. Kirish va motivatsiya

20.10 da FastAPI'da autentifikatsiyani qo'lda qurdik: parol hash, JWT, foydalanuvchi modeli — hammasi o'zimiz. Django'da esa autentifikatsiya tayyor keladi ("batareyalar ichida"): User modeli, parol hash, kirish/chiqish, sessiya, guruhlar va ruxsatlar — bir necha qator bilan ishlatiladi.

Django auth tizimi — sinab ko'rilgan, xavfsiz, to'liq. Foydalanuvchi yaratish (create_user), tekshirish (authenticate), kirish (login), himoya (login_required) — hammasi tayyor. Bu 21.1 dagi "batareyalar ichida" ning eng qimmatli misollaridan biri — xavfsizlik tayyor.

Real vaziyat. Bir jamoa auth'ni o'zi qurmoqchi bo'ldi — parol hash, sessiya, "parolni unutdim" — haftalab ish, va xavfsizlik xatolari (zaif hash, sessiya teshigi). Ular Django auth'iga o'tdi: User, authenticate, login — bir kunda to'liq, xavfsiz tizim. Django auth'i minglab loyihada sinalgan, xavfsizlik mutaxassislari tekshirgan. O'zi qurishdan — tayyorni ishlatish xavfsizroq va tezroq.

Bu darsda Django auth tizimini — User, kirish/chiqish, parol va ruxsatlarni o'rganamiz.

Bu darsda:

User modeli (tayyor)
Foydalanuvchi yaratish (create_user)
Parol boshqaruvi (hash avtomatik)
authenticate (tekshirish)
login/logout (sessiya)
login_required (himoya)
Guruhlar va ruxsatlar
Amaliy: to'liq auth oqimi

ℹ Misollarda Django auth (User, authenticate) bilan sinaladi.

2. Nazariya — chuqur tushuntirish

2.1. `User` modeli

Django tayyor User modeli beradi:

python

from django.contrib.auth.models import User

# maydonlar: username, password, email, first_name, last_name,
#            is_active, is_staff, is_superuser, date_joined

Maydon	Ma'no
`username`	Login (unique)
`password`	Hash (avtomatik)
`email`	Email
`is_staff`	Admin panelga kira oladimi
`is_superuser`	To'liq huquq

User — Django'ning tayyor foydalanuvchi modeli (django.contrib.auth). U 20.10 dagi qo'lda model o'rniga keladi — parol hash, maydonlar, metodlar tayyor. Kengaytirish (OneToOneField profil, 21.10) yoki almashtirish (custom User) mumkin.

2.2. Foydalanuvchi yaratish

create_user — foydalanuvchi yaratadi (parol avtomatik hash):

python

from django.contrib.auth.models import User

u = User.objects.create_user(
    username="ali",
    password="sirli123",       # avtomatik hash qilinadi
    email="ali@wisar.uz",
)

create_user — parolni avtomatik hash qiladi (pbkdf2_sha256, 20.10). Hech qachon User(password="...") to'g'ridan ishlatmang (hash qilinmaydi). create_superuser — admin (to'liq huquq).

2.3. Parol boshqaruvi

Django parolni xavfsiz boshqaradi:

python

u.set_password("yangi_parol")     # hash bilan o'rnatish
u.check_password("sirli123")      # tekshirish (True/False)
u.save()

set_password — parolni hash bilan o'rnatadi (to'g'ridan u.password = ... emas!); check_password — parol to'g'riligini tekshiradi. Django hash algorithmi (pbkdf2) — sinalgan, xavfsiz (20.10 — bir tomonlama hash).

2.4. `authenticate`

authenticate — login/parol to'g'riligini tekshiradi:

python

from django.contrib.auth import authenticate

user = authenticate(username="ali", password="sirli123")
if user is not None:
    # to'g'ri
else:
    # noto'g'ri (None)

authenticate — login va parolni tekshiradi: to'g'ri bo'lsa User, noto'g'ri bo'lsa None. Bu 20.10 dagi login endpointining Django versiyasi. U parolni hash bilan solishtiradi (xavfsiz).

2.5. `login`/`logout` (sessiya)

login/logout — foydalanuvchini sessiyaga kiritadi/chiqaradi:

python

from django.contrib.auth import login, logout

def kirish(request):
    user = authenticate(username=..., password=...)
    if user:
        login(request, user)          # sessiyaga kiritish
        # keyingi so'rovlarda request.user
    ...

def chiqish(request):
    logout(request)                   # sessiyadan chiqarish

login(request, user) — foydalanuvchini sessiyaga kiritadi (cookie orqali). Keyingi so'rovlarda request.user — joriy foydalanuvchi. logout — chiqaradi. Bu sessiya asosli (JWT'dan farqli, 20.10 — holatli).

2.6. `login_required`

login_required — view'ni himoyalaydi:

python

from django.contrib.auth.decorators import login_required

@login_required
def profil(request):
    return ...    # faqat kirgan foydalanuvchi

# kirmaganda → login sahifasiga yo'naltiradi

@login_required — view'ni faqat kirgan foydalanuvchiga ochadi (kirmagan → login sahifasiga yo'naltiradi). Bu 20.11 dagi himoya bog'liqligining Django versiyasi. request.user.is_authenticated bilan qo'lda ham tekshiriladi.

2.7. Guruhlar va ruxsatlar

Django ruxsat tizimi 20.11-bob:

python

from django.contrib.auth.models import Group, Permission

# guruh:
guruh = Group.objects.create(name="muharrirlar")
user.groups.add(guruh)

# ruxsat tekshiruvi:
user.has_perm("app.add_kurs")        # ruxsat bormi
user.is_staff                        # admin panel

Django guruh (rollar) va ruxsat (permission) tizimini beradi. Har model uchun avtomatik ruxsatlar (add, change, delete, view). Guruh — ruxsatlar to'plami (rol). Bu 20.11 dagi rol/ruxsat tizimining tayyor versiyasi.

2.8. Auth — tayyor xavfsizlik

Django beradi	20.10 da qo'lda
`User` modeli	O'zi yozdi
Parol hash	bcrypt/PyJWT
`authenticate`	Login mantiqi
Sessiya/login	JWT
Ruxsatlar	Rol tizimi

Django auth — to'liq, tayyor, xavfsiz tizim. 20.10 da qo'lda qurgan hamma narsa (hash, token/sessiya, ruxsat) tayyor keladi. Bu "batareyalar ichida" — xavfsizlikni o'zi qurmang, sinalganini ishlating.

3. Tez ma'lumotnoma

python

from django.contrib.auth.models import User, Group
from django.contrib.auth import authenticate, login, logout
from django.contrib.auth.decorators import login_required

# yaratish (parol avtomatik hash):
u = User.objects.create_user(username="ali", password="sirli123", email="...")
User.objects.create_superuser(username="admin", password="...")

# parol:
u.set_password("yangi"); u.check_password("sirli123")

# tekshirish va kirish:
user = authenticate(username="ali", password="sirli123")
login(request, user); logout(request)

# himoya:
@login_required
def profil(request): ...

# ruxsat:
user.groups.add(guruh); user.has_perm("app.add_kurs"); user.is_staff

Auth oqimi

create_user → authenticate → login (sessiya) → request.user → logout
login_required — himoya · groups/permissions — ruxsat

4. Batafsil misollar

Misollarda Django auth bilan sinaladi.

Misol 1 — `User` va foydalanuvchi yaratish

python

"""User modeli (tayyor); create_user (parol avtomatik hash); check_password; create_superuser."""

import warnings
warnings.filterwarnings("ignore")

from io import StringIO

import django
from django.conf import settings

settings.configure(
    DEBUG=False,
    DATABASES={"default": {"ENGINE": "django.db.backends.sqlite3", "NAME": ":memory:"}},
    INSTALLED_APPS=["django.contrib.contenttypes", "django.contrib.auth"],
    DEFAULT_AUTO_FIELD="django.db.models.BigAutoField",
)
django.setup()

from django.core.management import call_command

call_command("migrate", stdout=StringIO(), verbosity=0)

from django.contrib.auth.models import User


def main() -> None:
    print("=== 1. Foydalanuvchi yaratish ===")
    u = User.objects.create_user(username="ali", password="sirli123", email="ali@wisar.uz")
    print(f"  username: {u.username}, email: {u.email}")

    print("\n=== 2. Parol avtomatik hash ===")
    print(f"  hash algoritmi: {u.password.split('$')[0]}")
    print(f"  ochiq parol emas: {u.password != 'sirli123'}")

    print("\n=== 3. Parol tekshirish ===")
    print(f"  to'g'ri parol: {u.check_password('sirli123')}")
    print(f"  xato parol: {u.check_password('xato')}")

    print("\n=== 4. Superuser ===")
    admin = User.objects.create_superuser(username="admin", password="admin123")
    print(f"  is_superuser: {admin.is_superuser}, is_staff: {admin.is_staff}")
    print(f"  jami foydalanuvchi: {User.objects.count()}")
    print("  ⭐ User — tayyor model; create_user — parol avtomatik hash")


if __name__ == "__main__":
    main()

Natijaning muhim qismi:

text

=== 1. Foydalanuvchi yaratish ===
  username: ali, email: ali@wisar.uz

=== 2. Parol avtomatik hash ===
  hash algoritmi: pbkdf2_sha256
  ochiq parol emas: True

=== 3. Parol tekshirish ===
  to'g'ri parol: True
  xato parol: False

=== 4. Superuser ===
  is_superuser: True, is_staff: True
  jami foydalanuvchi: 2
  ⭐ User — tayyor model; create_user — parol avtomatik hash

Nima ko'rsatdi: 2.1, 2.2, 2.3-bo'limlar.

Misol 2 — `authenticate` va parol boshqaruvi

python

"""authenticate (login/parol tekshirish); to'g'ri → User, xato → None; set_password (parol o'zgartirish)."""

import warnings
warnings.filterwarnings("ignore")

from io import StringIO

import django
from django.conf import settings

settings.configure(
    DEBUG=False,
    DATABASES={"default": {"ENGINE": "django.db.backends.sqlite3", "NAME": ":memory:"}},
    INSTALLED_APPS=["django.contrib.contenttypes", "django.contrib.auth"],
    DEFAULT_AUTO_FIELD="django.db.models.BigAutoField",
)
django.setup()

from django.core.management import call_command

call_command("migrate", stdout=StringIO(), verbosity=0)

from django.contrib.auth import authenticate
from django.contrib.auth.models import User


def main() -> None:
    User.objects.create_user(username="ali", password="sirli123")

    print("=== 1. To'g'ri login/parol ===")
    user = authenticate(username="ali", password="sirli123")
    print(f"  authenticate → {user.username if user else None}")

    print("\n=== 2. ⚠️ Xato parol ===")
    user = authenticate(username="ali", password="xato")
    print(f"  authenticate → {user} (None)")

    print("\n=== 3. ⚠️ Yo'q foydalanuvchi ===")
    user = authenticate(username="yoq", password="sirli123")
    print(f"  authenticate → {user} (None)")

    print("\n=== 4. Parol o'zgartirish (set_password) ===")
    u = User.objects.get(username="ali")
    u.set_password("yangi_parol")
    u.save()
    print(f"  eski parol: {authenticate(username='ali', password='sirli123')}")
    print(f"  yangi parol: {authenticate(username='ali', password='yangi_parol').username}")
    print("  ⭐ authenticate — to'g'ri→User, xato→None; set_password — hash bilan")


if __name__ == "__main__":
    main()

Natijaning muhim qismi:

text

=== 1. To'g'ri login/parol ===
  authenticate → ali

=== 2. ⚠️ Xato parol ===
  authenticate → None (None)

=== 3. ⚠️ Yo'q foydalanuvchi ===
  authenticate → None (None)

=== 4. Parol o'zgartirish (set_password) ===
  eski parol: None
  yangi parol: ali
  ⭐ authenticate — to'g'ri→User, xato→None; set_password — hash bilan

Nima ko'rsatdi: 2.3, 2.4-bo'limlar.

Misol 3 — Guruhlar va ruxsatlar

python

"""guruhlar (Group, rol); guruhga qo'shish; ruxsatlar (Permission); has_perm; is_staff/is_superuser."""

import warnings
warnings.filterwarnings("ignore")

from io import StringIO

import django
from django.conf import settings

settings.configure(
    DEBUG=False,
    DATABASES={"default": {"ENGINE": "django.db.backends.sqlite3", "NAME": ":memory:"}},
    INSTALLED_APPS=["django.contrib.contenttypes", "django.contrib.auth"],
    DEFAULT_AUTO_FIELD="django.db.models.BigAutoField",
)
django.setup()

from django.core.management import call_command

call_command("migrate", stdout=StringIO(), verbosity=0)

from django.contrib.auth.models import Group, Permission, User


def main() -> None:
    ali = User.objects.create_user(username="ali", password="p")
    admin = User.objects.create_superuser(username="admin", password="p")

    print("=== 1. Guruh yaratish (rol) ===")
    muharrir = Group.objects.create(name="muharrirlar")
    ali.groups.add(muharrir)
    print(f"  ali guruhlari: {list(ali.groups.values_list('name', flat=True))}")

    print("\n=== 2. Ruxsat guruhga ===")
    ruxsat = Permission.objects.filter(codename="add_user").first()
    muharrir.permissions.add(ruxsat)
    print(f"  muharrirlar ruxsatlari: {list(muharrir.permissions.values_list('codename', flat=True))}")

    print("\n=== 3. Ruxsat tekshiruvi ===")
    ali_yangi = User.objects.get(username="ali")      # keshni yangilash
    print(f"  ali 'auth.add_user': {ali_yangi.has_perm('auth.add_user')}")

    print("\n=== 4. Superuser barcha ruxsat ===")
    print(f"  admin is_superuser: {admin.is_superuser}")
    print(f"  admin has_perm (har qanday): {admin.has_perm('auth.add_user')}")
    print("  ⭐ Group — rol; Permission — ruxsat; superuser — barchasi")


if __name__ == "__main__":
    main()

Natijaning muhim qismi:

text

=== 1. Guruh yaratish (rol) ===
  ali guruhlari: ['muharrirlar']

=== 2. Ruxsat guruhga ===
  muharrirlar ruxsatlari: ['add_user']

=== 3. Ruxsat tekshiruvi ===
  ali 'auth.add_user': True

=== 4. Superuser barcha ruxsat ===
  admin is_superuser: True
  admin has_perm (har qanday): True
  ⭐ Group — rol; Permission — ruxsat; superuser — barchasi

Nima ko'rsatdi: 2.7-bo'lim.

Misol 4 — Amaliy: to'liq auth oqimi

Ro'yxatdan o'tish, kirish, himoyalangan sahifa va chiqish — to'liq auth oqimini Client bilan ko'rsatami. Bu — real Django auth ilovasining namunasi.

python

"""to'liq auth oqimi: ro'yxatdan o'tish, login, himoyalangan view (login_required), logout; sessiya."""

import warnings
warnings.filterwarnings("ignore")

import sys
import tempfile
import types
from io import StringIO

import django
from django.conf import settings

settings.configure(
    DEBUG=False,
    DATABASES={"default": {"ENGINE": "django.db.backends.sqlite3", "NAME": ":memory:"}},
    INSTALLED_APPS=[
        "django.contrib.contenttypes",
        "django.contrib.auth",
        "django.contrib.sessions",
        "wisar",
    ],
    MIDDLEWARE=[
        "django.contrib.sessions.middleware.SessionMiddleware",
        "django.contrib.auth.middleware.AuthenticationMiddleware",
    ],
    ROOT_URLCONF=__name__,
    ALLOWED_HOSTS=["*"],
    SECRET_KEY="namuna",
    DEFAULT_AUTO_FIELD="django.db.models.BigAutoField",
)
_app = types.ModuleType("wisar")
_app.__path__ = [tempfile.gettempdir()]
sys.modules["wisar"] = _app
django.setup()

from django.contrib.auth import authenticate, login, logout
from django.contrib.auth.decorators import login_required
from django.contrib.auth.models import User
from django.core.management import call_command
from django.http import JsonResponse
from django.urls import path

call_command("migrate", stdout=StringIO(), verbosity=0)


def kirish(request):
    user = authenticate(request, username=request.POST["username"], password=request.POST["password"])
    if user is None:
        return JsonResponse({"xato": "login yoki parol xato"}, status=401)
    login(request, user)
    return JsonResponse({"holat": "kirdingiz", "ism": user.username})


@login_required
def profil(request):
    return JsonResponse({"ism": request.user.username, "kirgan": request.user.is_authenticated})


def chiqish(request):
    logout(request)
    return JsonResponse({"holat": "chiqdingiz"})


urlpatterns = [
    path("kirish/", kirish),
    path("profil/", profil),
    path("chiqish/", chiqish),
]


def main() -> None:
    User.objects.create_user(username="ali", password="sirli123")

    from django.test import Client
    client = Client()

    print("=== 1. Kirmasdan himoyalangan (yo'naltirish) ===")
    javob = client.get("/profil/")
    print(f"  /profil/ (kirmagan) → status {javob.status_code} (302 yo'naltirish)")

    print("\n=== 2. Kirish (login) ===")
    javob = client.post("/kirish/", {"username": "ali", "password": "sirli123"})
    print(f"  status {javob.status_code} → {javob.json()}")

    print("\n=== 3. Himoyalangan sahifa (kirgach) ===")
    javob = client.get("/profil/")
    print(f"  /profil/ → status {javob.status_code}, {javob.json()}")

    print("\n=== 4. Chiqish (logout) ===")
    client.get("/chiqish/")
    javob = client.get("/profil/")
    print(f"  chiqgach /profil/ → status {javob.status_code} (yana himoyalangan)")
    print("  ⭐ authenticate → login (sessiya) → login_required → logout")


if __name__ == "__main__":
    main()

Natijaning muhim qismi:

text

=== 1. Kirmasdan himoyalangan (yo'naltirish) ===
  /profil/ (kirmagan) → status 302 (302 yo'naltirish)

=== 2. Kirish (login) ===
  status 200 → {'holat': 'kirdingiz', 'ism': 'ali'}

=== 3. Himoyalangan sahifa (kirgach) ===
  /profil/ → status 200, {'ism': 'ali', 'kirgan': True}

=== 4. Chiqish (logout) ===
  chiqgach /profil/ → status 302 (yana himoyalangan)
  ⭐ authenticate → login (sessiya) → login_required → logout

Nima ko'rsatdi: 2.4, 2.5, 2.6-bo'limlar.

5. To'g'ri va noto'g'ri tushunishlar

Noto'g'ri fikr	To'g'risi
"Auth'ni o'zi qurish"	Django tayyor (xavfsiz)
"`User(password=...)`"	`create_user` (hash)
"Parolni to'g'ridan o'rnatish"	`set_password` (hash)
"Parolni solishtirish `==`"	`check_password`
"Himoyani qo'lda tekshiruv"	`@login_required`
"Ruxsat tizimini qurish"	Django beradi (guruh/perm)
"JWT majburiy"	Django — sessiya (yoki JWT)
"Parol hash o'zi yozish"	Django hash (pbkdf2)

6. Keng tarqalgan xatolar va yechimlari

1. Userni to'g'ridan yaratish

python

User(username="ali", password="sirli123")    # ⚠️ hash yo'q
User.objects.create_user(username="ali", password="sirli123")   # ✅

2. Parolni to'g'ridan o'rnatish

python

u.password = "yangi"                          # ⚠️ hash yo'q
u.set_password("yangi"); u.save()             # ✅

3. Parolni == bilan solishtirish

python

if u.password == parol:                       # ⚠️ hash bilan solishmaydi
if u.check_password(parol):                    # ✅

4. Himoyani qo'lda (login_required o'rniga)

python

def profil(request):
    if not request.user.is_authenticated: ...  # ⚠️ har view'da
@login_required                                # ✅
def profil(request): ...

5. authenticatesiz login

python

login(request, User.objects.get(...))          # ⚠️ tekshirilmagan
user = authenticate(...); if user: login(...)  # ✅

6. Auth'ni o'zi qurish

python

# parol hash, sessiya, ruxsat qo'lda           # ⚠️ xavfsizlik xavfi
# Django auth ishlating (sinalgan)              # ✅

7. Superuserni is_superuser=True bilan

python

User.objects.create_user(is_superuser=True)    # ⚠️ to'liq emas
User.objects.create_superuser(...)             # ✅

7. Integratsiya — bu bilim qayerda kerak bo'ladi

20.10-dars (o'tilgan): JWT — qo'lda auth (taqqoslash)
21.5-dars (o'tilgan): admin — auth bilan kirish
21.10-dars (o'tilgan): OneToOneField — profil kengaytirish
21.14-dars: DRF ruxsat — API auth
20.11-dars (o'tilgan): ruxsatlar — guruh/permission

8. Eng yaxshi amaliyotlar

Django auth'ni ishlating (o'zi qurmang).
create_user/create_superuser bilan yarating (hash).
set_password/check_password bilan parol (to'g'ridan emas).
authenticate bilan tekshiring (login'dan oldin).
@login_required bilan himoyalang.
Guruh (rol) va ruxsatlarni ishlating.
Userni OneToOneField bilan kengaytiring (profil).
Custom User kerak bo'lsa — loyiha boshida belgilang.

9. Amaliy topshiriq

Vazifa 1: Bashorat qiling

python

1.  # User modeli qayerdan?
2.  # create_user parolni nima qiladi?
3.  # set_password nima?
4.  # check_password nima?
5.  # authenticate nima qaytaradi?
6.  # login nima qiladi?
7.  # login_required nima?
8.  # request.user nima?
9.  # Group nima?
10. # has_perm nima?
11. # superuser nima?
12. # auth'ni o'zi qurish kerakmi?

Javoblar

django.contrib.auth.models (tayyor)
Avtomatik hash qiladi
Parolni hash bilan o'rnatadi
Parol to'g'riligini tekshiradi
To'g'ri → User, xato → None
Foydalanuvchini sessiyaga kiritadi
View'ni kirgan foydalanuvchiga cheklaydi
Joriy foydalanuvchi (sessiyadan)
Rol (ruxsatlar to'plami)
Ruxsat bor-yo'qligini tekshiradi
To'liq huquqli foydalanuvchi
Yo'q (Django tayyor, xavfsiz)

Vazifa 2: Xatolarni tuzating

python

1.  User(username="ali", password="p")     # hash

2.  u.password = "yangi"                    # set_password

3.  if u.password == parol:                 # check

4.  login(request, User.objects.get(...))   # authenticate

5.  def profil(request):
        if not request.user...              # login_required

Javoblar

python

1.  User.objects.create_user(username="ali", password="p")

2.  u.set_password("yangi"); u.save()

3.  if u.check_password(parol):

4.  user = authenticate(...); 
    if user: login(request, user)

5.  @login_required
    def profil(request): ...

Vazifa 3: Ro'yxatdan o'tish

Registratsiya tizimi:

create_user bilan foydalanuvchi
Parol validatsiyasi (forma bilan)
Kirish (authenticate + login)
Client bilan test

Vazifa 4: Parol boshqaruvi

Parol amallari:

Yaratish (hash)
O'zgartirish (set_password)
Tekshirish (check_password)
Xato holatlari test

Vazifa 5: Himoyalangan sahifalar

login_required bilan:

Ochiq va himoyalangan view'lar
Kirmagan → yo'naltirish
Kirgach → kirish
Client bilan test

Vazifa 6: Guruh va ruxsat

Ruxsat tizimi:

Guruhlar (admin, muharrir, o'quvchi)
Ruxsatlar guruhga
has_perm tekshiruvi
Har rol test

Vazifa 7: O'ylash

Django auth — tayyor, sinalgan xavfsizlik tizimi: 20.10 da FastAPI'da qo'lda qurgan hamma narsa (parol hash, login, sessiya, ruxsat) tayyor keladi. "Xavfsizlikni o'zi qurmang, sinalganini ishlating" — muhim tamoyil. Xavfsizlik kabi nozik sohada tayyor, ko'p sinalgan yechimni ishlatishning afzalligi nima, va nima uchun "o'zi qurish" (do it yourself) xavfsizlikda ayniqsa xatarli?

Javob

Qisqa javob: Django auth — minglab loyihada ishlatilgan, xavfsizlik mutaxassislari tekshirgan, ko'p yillik sinovdan o'tgan. Uni ishlatish — bu jamoaviy tajribani olish. "O'zi qurish" xavfsizlikda xatarli, chunki xavfsizlik nozik: bitta xato (zaif hash, sessiya teshigi, timing hujumi) — butun tizim buziladi, va bu xatolarni sezish qiyin (ishlaydi, lekin himoyasiz). Sinalgan yechim bu xatolarni allaqachon tuzatgan. "Xavfsizlikni o'zi qurmang" — chunki siz bilmagan hujumlarni mutaxassislar biladi.

1. Tayyor vs o'zi qurish

Tayyor (Django auth)	O'zi qurish
Ko'p sinalgan	Sinalmagan
Mutaxassis tekshirgan	Bir kishi
Ma'lum hujumlar yopiq	Noma'lum teshiklar
Yangilanib turadi	Eskiradi

2. Nega xavfsizlikda ayniqsa muhim

Xavfsizlik nozik: kod ishlaydi, lekin himoyasiz bo'lishi mumkin (xato ko'rinmaydi). Bitta zaiflik — butun tizim. Funksional xato darrov ko'rinadi; xavfsizlik xatosi — hujum bo'lguncha yashirin.

3. "O'zi qurish" xatarli, chunki

Xavf	Sabab
Zaif hash	Algoritm bilmaslik
Sessiya teshigi	Nozik detallar
Timing hujum	Sezilmaydigan
Yangilanmaslik	Yangi hujumlar

4. "Sinalganini ishlat" boshqa joyda

Soha	Tayyor yechim
Auth	Django auth
Kriptografiya	Kutubxona (o'zi yozma)
Parol hash	bcrypt/pbkdf2
TLS	Standart kutubxona

5. Muhandislik saboqlari

Xavfsizlikni o'zi qurmang (sinalganini ol)
Xavfsizlik nozik — xato yashirin
Tayyor yechim — jamoaviy tajriba
"Kriptografiyani o'zi yozma" — klassik qoida

6. Xulosa

Django auth — tayyor, sinalgan, xavfsiz
O'zi qurish xatarli (nozik, yashirin xato)
Sinalgan yechim — ma'lum hujumlar yopiq
"Xavfsizlikni o'zi qurmang" — muhim qoida

Nimani mustahkamlaydi: 2.1–2.8-bo'limlar.

Xulosa

Bu darsda Django autentifikatsiya tizimini o'rgandik.

Eng muhim uch fikr:

User va parol boshqaruvi. Django tayyor User modeli beradi (django.contrib.auth) — 20.10 dagi qo'lda model o'rniga. create_user/create_superuser foydalanuvchi yaratadi va parolni avtomatik hash qiladi (pbkdf2_sha256). set_password — parolni hash bilan o'rnatadi (u.password = ... emas!), check_password — parol to'g'riligini tekshiradi. Django hash algorithmi sinalgan va xavfsiz (bir tomonlama, 20.10).
Kirish va himoya. authenticate(username, password) — login/parolni tekshiradi (to'g'ri → User, xato → None). login(request, user) — foydalanuvchini sessiyaga kiritadi (cookie orqali); keyingi so'rovlarda request.user joriy foydalanuvchini beradi; logout chiqaradi. @login_required — view'ni faqat kirgan foydalanuvchiga ochadi (kirmagan → login sahifasiga yo'naltiradi) — 20.11 dagi himoya bog'liqligining Django versiyasi.
Ruxsatlar va tayyor xavfsizlik. Django guruh (rollar) va ruxsat (permission) tizimini beradi: har model uchun avtomatik ruxsatlar (add, change, delete, view), guruh — ruxsatlar to'plami, has_perm/is_staff/is_superuser tekshiruvi. Eng muhimi — Django auth to'liq, tayyor, sinalgan xavfsizlik tizimi: 20.10 da qo'lda qurgan hamma narsa tayyor keladi. Xavfsizlik nozik (xato yashirin) — shuning uchun "xavfsizlikni o'zi qurmang, sinalganini ishlating".

Keyingi darsda Django REST Framework (DRF) ni o'rganamiz: Django ustida REST API qurish — API view'lar, so'rov/javob va DRF'ning "batareyalar ichida" API vositalari.

Ulashish:Telegram'da

Izohlar (0)

Izoh yozish uchun kiring.

Hozircha izoh yo'q. Birinchi bo'ling!

21.11-dars: Autentifikatsiya tizimi

1. Kirish va motivatsiya

2. Nazariya — chuqur tushuntirish

2.1. User modeli

2.2. Foydalanuvchi yaratish

2.3. Parol boshqaruvi

2.4. authenticate

2.5. login/logout (sessiya)

2.6. login_required

2.7. Guruhlar va ruxsatlar

2.8. Auth — tayyor xavfsizlik

3. Tez ma'lumotnoma

4. Batafsil misollar

Misol 1 — User va foydalanuvchi yaratish

Misol 2 — authenticate va parol boshqaruvi

Misol 3 — Guruhlar va ruxsatlar

Misol 4 — Amaliy: to'liq auth oqimi

5. To'g'ri va noto'g'ri tushunishlar

6. Keng tarqalgan xatolar va yechimlari

7. Integratsiya — bu bilim qayerda kerak bo'ladi

8. Eng yaxshi amaliyotlar

9. Amaliy topshiriq

Xulosa

Izohlar (0)

2.1. `User` modeli

2.4. `authenticate`

2.5. `login`/`logout` (sessiya)

2.6. `login_required`

Misol 1 — `User` va foydalanuvchi yaratish

Misol 2 — `authenticate` va parol boshqaruvi