---
source: https://iinventedlight.com/library/notes/django-auth.md
title: "Django auth handles users, groups, permissions, and sessions"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source_license: "BSD-3-Clause (django/django); prose restates cited source lines in own words"
license_family: django-bsd3
attribution: "Summary by iinventedlight (AI-assisted). Sources: Django docs, User authentication in Django, BSD-3-Clause (django/django); Django source, django.contrib.auth, BSD-3-Clause (django/django). Notices: Django documentation and source (django/django): Copyright (c) Django Software Foundation and individual contributors; BSD-3-Clause (https://raw.githubusercontent.com/django/django/stable/6.1.x/LICENSE)."
author: "iinventedlight (synthesis of cited sources); text drafted with AI assistance"
date: 2026-11-10
status: published
approved_by: "Cole Withington, 2026-11-10 10:08 PT, Librarian chat widget t33s2: \"Yes, publish all 25 Django and Vue drafts\""
checked_on: 2026-11-10
as_of: 2026-11-10
confidence: medium
untested: "No Django project was run for this note; only the fetched documentation and source files were read."
category: coding-references
topic_area: "code-backend: Django auth"
tags: [django, auth, users, permissions, sessions]
client: Librarian
sources:
  - id: S1
    title: "User authentication in Django"
    publisher: Django docs
    url: https://docs.djangoproject.com/en/6.1/topics/auth/
    accessed: 2026-11-10
    license: "BSD-3-Clause"
  - id: S2
    title: "django.contrib.auth"
    publisher: Django source
    url: https://github.com/django/django/blob/stable/6.1.x/django/contrib/auth/__init__.py
    accessed: 2026-11-10
    license: "BSD-3-Clause"
---
# Django auth handles users, groups, permissions, and sessions

**Answer:** Django ships a user authentication system that handles user accounts, groups, permissions, and cookie-based user sessions. In the docs, "authentication" is also used as a name for both authentication and authorization: verifying who a user is, and determining what that user is allowed to do.

## Bundled pieces

The auth system includes users, yes/no permissions, groups, a configurable password hasher, login forms and views, and a pluggable backend system. The default setup is included in the `settings.py` created by `startproject`, with `django.contrib.auth` in `INSTALLED_APPS`.

## Functions

`authenticate()` returns a User when the given credentials are valid. `login()` persists a user id and a backend in the request so the user does not have to reauthenticate on every request. `get_user_model()` returns the User model that is active in the project.

## See also

- [django-admin](https://iinventedlight.com/library/notes/django-admin/)
- [django-middleware](https://iinventedlight.com/library/notes/django-middleware/)

## Claims

- id: C1
  claim: Django ships a user authentication system.
  source: S1
  evidence: "Django comes with a user authentication system."

- id: C2
  claim: The system handles accounts, groups, permissions, and cookie sessions.
  source: S1
  evidence: "It handles user accounts, groups, permissions and cookie-based user sessions."

- id: C3
  claim: authenticate() returns a User when the credentials are valid.
  source: S2
  evidence: "If the given credentials are valid, return a User object."

- id: C4
  claim: login() persists a user id and a backend on the request.
  source: S2
  evidence: "Persist a user id and a backend in the request."

## Sources

- [S1] User authentication in Django. Django docs. https://docs.djangoproject.com/en/6.1/topics/auth/ . License: BSD-3-Clause. Accessed 2026-11-10.

- [S2] django.contrib.auth. Django source. https://github.com/django/django/blob/stable/6.1.x/django/contrib/auth/__init__.py . License: BSD-3-Clause. Accessed 2026-11-10.


License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted). Sources and notices: Django documentation and source (django/django): Copyright (c) Django Software Foundation and individual contributors; BSD-3-Clause (https://raw.githubusercontent.com/django/django/stable/6.1.x/LICENSE). Text was condensed and changed from the originals.

---

Agents: [/agents.md](/agents.md) | [/.well-known/agent-library.json](/.well-known/agent-library.json).