CODEWITHSUNDEEP
django
Cliff F
Cliff F

Reputation: 391

Restrict access to view for unique user in Django w/o providing username and password

I'm trying to limit access to a Django view for a unique user, but shouldn't require the user to register. The use case is a link would be sent to a customer to view a page with private information that only he/she can see, but doesn't require them to register with the site. I'm thinking using some type of token might be the way to go but I'm not sure. What is the best way to solve this?

Upvotes: 0

Views: 46

Answers (1)

arocks
arocks

Reputation: 2882

Here is typically how such a use case is implemented:

  1. A new entry is created in a model with a unique (and long) random token and a foreign key to the user information
  2. A URL endpoint consisting of the random token in the path or part of query parameters is sent via email.
  3. The view for that URL looks up the entry in the model and retrieves the corresponding user information.
  4. Optionally, the entry is deleted so that the URL cannot be reused in case the email falls into wrong hands.

Upvotes: 2

Related Questions