Working with the authenticated user

After authentication, AuthUser gives the application a small immutable identity snapshot.

Protecting a page

if not auth.is_logged_in():
    auth.login()
user = auth.get_auth_user()

The default redirect signal stops execution until the adapter sends the response. Reading an absent user raises NotLoggedInException.

Identifying a user

user_id = user.id
email = user.email

Associate local records with the provider ID. Treat it as a string. Email addresses can change. The client exposes only ID and email; changes to application records do not update the provider.

Keeping permissions in the application

Authentication identifies the visitor. Check their permissions before showing private records or allowing changes. For example, load an order using both its order ID and authenticated user ID. Escape identity values when rendering HTML.

---

Next, see Responding to a new authentication.