Django 用户认证系统完全指南

一、认证系统核心组件

二、用户模型配置

1. 自定义用户模型（推荐）

# models.py
from django.contrib.auth.models import AbstractUser

class CustomUser(AbstractUser):
    mobile = models.CharField('手机号', max_length=15, unique=True)
    avatar = models.ImageField('头像', upload_to='avatars/')
    wechat_openid = models.CharField('微信ID', max_length=64, blank=True)
    
    # 必须配置
    USERNAME_FIELD = 'mobile'  # 替换登录字段
    REQUIRED_FIELDS = ['username']  # createsuperuser必填字段

# settings.py
AUTH_USER_MODEL = 'accounts.CustomUser'  # 关键配置

2. 用户管理器定制

from django.contrib.auth.models import BaseUserManager

class CustomUserManager(BaseUserManager):
    def create_user(self, mobile, password=None, **extra_fields):
        if not mobile:
            raise ValueError('必须填写手机号')
        user = self.model(mobile=mobile, **extra_fields)
        user.set_password(password)
        user.save(using=self._db)
        return user

三、认证流程实现

1. 登录/退出视图

# urls.py
from django.contrib.auth.views import LoginView, LogoutView

urlpatterns = [
    path('login/', LoginView.as_view(
        template_name='accounts/login.html',
        redirect_authenticated_user=True
    ), name='login'),
    path('logout/', LogoutView.as_view(next_page='/'), name='logout'),
]

# login.html模板关键代码
<form method="post">
    {% csrf_token %}
    {{ form.username.label_tag }} {{ form.username }}
    {{ form.password.label_tag }} {{ form.password }}
    <button type="submit">登录</button>
</form>

2. 用户注册实现

# forms.py
from django.contrib.auth.forms import UserCreationForm

class RegisterForm(UserCreationForm):
    class Meta:
        model = CustomUser
        fields = ('mobile', 'username', 'password1', 'password2')

# views.py
def register(request):
    if request.method == 'POST':
        form = RegisterForm(request.POST)
        if form.is_valid():
            user = form.save()
            login(request, user)  # 注册后自动登录
            return redirect('home')
    else:
        form = RegisterForm()
    return render(request, 'accounts/register.html', {'form': form})

四、权限控制系统

1. 权限校验装饰器

from django.contrib.auth.decorators import login_required, permission_required

@login_required
def profile(request):
    return render(request, 'accounts/profile.html')

@permission_required('polls.add_choice', raise_exception=True)
def create_poll(request):
    # 需要添加choice权限的用户才能访问
    pass

2. 模板权限判断

{% if perms.polls.add_choice %}
    <a href="{% url 'create_poll' %}">新建投票</a>
{% endif %}

{% if user.is_staff %}
    <div class="admin-panel">管理面板</div>
{% endif %}

五、第三方认证集成

1. 微信登录配置

# settings.py
SOCIAL_AUTH_WEIXIN_KEY = 'your-appid'
SOCIAL_AUTH_WEIXIN_SECRET = 'your-secret'

AUTHENTICATION_BACKENDS = [
    'django.contrib.auth.backends.ModelBackend',
    'social_core.backends.weixin.WeixinOAuth2',
]

# 使用python-social-auth中间件
MIDDLEWARE += ['social_django.middleware.SocialAuthExceptionMiddleware']

2. 社交登录回调处理

# views.py
from social_django.views import auth

def social_login(request, backend):
    return auth(request, backend)

def social_complete(request, backend):
    # 处理用户资料同步
    return redirect('profile')

六、安全增强措施

1. 密码策略配置

# settings.py
AUTH_PASSWORD_VALIDATORS = [
    {'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
     'OPTIONS': {'min_length': 8}},
    {'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator'},
]

2. 会话安全设置

SESSION_COOKIE_AGE = 1209600  # 两周过期
SESSION_COOKIE_SECURE = True    # 仅HTTPS传输
SESSION_COOKIE_HTTPONLY = True  # 防止XSS
SESSION_ENGINE = 'django.contrib.sessions.backends.cached_db'  # 缓存+DB存储

七、企业级扩展方案

1. JWT认证集成

# settings.py
REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework_simplejwt.authentication.JWTAuthentication',
    ]
}

# 生成Token的视图
from rest_framework_simplejwt.views import TokenObtainPairView

class CustomTokenObtainPairView(TokenObtainPairView):
    serializer_class = CustomTokenObtainPairSerializer

2. 多因子认证(MFA)

# 使用django-two-factor-auth
MIDDLEWARE += ['two_factor.middleware.threadlocals.ThreadLocals']

AUTHENTICATION_BACKENDS = [
    'two_factor.auth_backends.TwoFactorAuthBackend',
    # ...其他后端
]

总结​​：
本教程涵盖Django用户认证系统的核心功能与高级扩展方案，从基础的用户模型定制到企业级的JWT、MFA集成，提供完整的用户生命周期管理方案。建议开发时遵循以下流程：

1. 优先定义自定义用户模型
2. 使用内置认证视图处理基础流程
3. 按需集成第三方认证方式
4. 严格配置安全策略
5. 根据业务需求扩展权限系统