Django Admin without Authentication

Question

Is there a ready way to use the Django admin page without any form of authentication? I know I can use this method, but that was for Django 1.3. Are there any changes that would let me do this more easily in Django 1.6?

My main motivation for this is that I want to have as few database tables as possible, and I am using this only locally, so there is no need for any sort of authentication (I'm only ever running the server on localhost anyways).

score 17 · Answer 1 · answered Oct 12 '16 at 21:01

17

The accepted answer is already super simple however after messing around with this I found that in recent versions of Django (since admin.site.has_permission became a thing... >= 1.8?) you can do it without middleware.

In your project's urls.py:

from django.contrib import admin

class AccessUser:
    has_module_perms = has_perm = __getattr__ = lambda s,*a,**kw: True

admin.site.has_permission = lambda r: setattr(r, 'user', AccessUser()) or True

# Register the admin views or call admin.autodiscover()

urlpatterns = [
    # Your url configs then...
    url(r'^admin/', admin.site.urls),
]

If you have AccessUser extend User you can leave out the __getattr__ portion which is a hacky way to return something when user.pk or similar is called.

answered Oct 12 '16 at 21:01

roblinton

190
1
5

2

Note that when one tries to change something using this construction, django admin complains: `insert or update on table "django_admin_log" violates foreign key constraint "django_admin_log_user_id_c564eba6_fk_auth_user_id" DETAIL: Key (user_id)=(1) is not present in table "auth_user".`, so you do need to have a user if you need that functionality. – Jieter Nov 14 '17 at 10:12
This is what i was looking for past one week. I didn't need login page since my application is internally used. – Harshita Sep 25 '19 at 10:24
Here a ticket with solution for problem mentioned by @Jieter: https://stackoverflow.com/questions/58736821/prevent-django-admin-changes-from-creating-a-logentry – Mateusz Sep 25 '22 at 19:14

Jamie Cockburn · Accepted Answer · 2020-09-21T13:39:40.437

13

Create a module auto_auth.py:

from django.contrib.auth.models import User
from django.utils.deprecation import MiddlewareMixin

class AutoAuthMiddleware(MiddlewareMixin):
    def process_request(self, request):
        request.user = User.objects.filter()[0]

Edit MIDDLEWARE in your settings.py:

Remove 'django.contrib.auth.middleware.AuthenticationMiddleware'
Add 'auto_auth.AutoAuthMiddleware'

You can change User.objects.filter()[0] to something else if you want a particular user.

In response to your comment: yes. To run the Django admin without users at all, try this:

class User:
    is_superuser = True
    is_active = True
    is_staff = True
    id = 1

def return_true(*args, **kwargs):
    return True
User.has_module_perms = return_true
User.has_perm = return_true

class AutoAuthMiddleware(MiddlewareMixin):
    def process_request(self, request):
        request.user = User()

And remove 'django.contrib.auth' from INSTALLED_APPS

But if you use any apps that depend on the auth app, you're going to have a bad time.

edited Sep 21 '20 at 13:39

answered Jun 24 '14 at 15:48

Jamie Cockburn

7,379
1
24
37

Is there a way to do away with users completely or is the admin site tied specifically to the User model? Or, could I create a new fake superuser for each request? – pseudonym117 Jun 24 '14 at 15:52
thank you! I am using this as a simple editor for an SQLite database for a completely separate application, so this will work perfectly. – pseudonym117 Jun 24 '14 at 18:03
1

Note that in Django 1.10, the [interface to middleware changed](https://docs.djangoproject.com/en/1.11/topics/http/middleware/#upgrading-middleware). – RichardW Nov 10 '17 at 06:55
2

This Answer is outdated. – NoName Jun 16 '20 at 00:33
Does not work with Django 3.2 – nerdoc Oct 11 '21 at 07:34

score 5 · Answer 3 · answered Jul 02 '18 at 08:08

The accepted answer adapted for Django version >= 1.10

/[yourapp]/middleware.py:

from django.contrib.auth.models import User

class AuthenticationMiddleware(object):
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        request.user = User.objects.filter()[0]
        return self.get_response(request)

In [yourproject]/settings.py for the MIDDLEWARE list:

Comment or remove: 'django.contrib.auth.middleware.AuthenticationMiddleware',
Append: '[yourapp].middleware.AuthenticationMiddleware',

Probably obvious to most people but note that the solution still requires one user to exist. Create one manually python manage.py createsuperuser or automatically with a script:

score 4 · Answer 4 · answered Mar 23 '20 at 01:40

Another Option allows access from anyone: get the first user to bypass authentication

# app/admin.py
from django.contrib.auth.models import User
anonymous_user = User.objects.all().first()
admin.site.has_permission = lambda r: setattr(r, 'user', anonymous_user) or True

Chiheb Nexus · Answer 5 · 2019-09-20T01:13:24.007

0

For the newer versions of django >=2.1 you need to do something like this:

auto_auth.py

class User:
    is_superuser = True
    is_active = True
    is_staff = True
    id = 1
    pk = 1


User.has_module_perms = True
User.has_perm = True


class Middleware(object):
     def __init__(self, get_response):
          self.response = get_response

     def __call__(self, request):
         request.user = User()
         return self.response(request)

And also don't forget to modify your settings middleware and deactivate django.contrib.auth and add auto_auth

edited Sep 20 '19 at 01:13

answered May 13 '19 at 10:36

Chiheb Nexus

9,104
4
30
43

`(admin.E408) 'django.contrib.auth.middleware.AuthenticationMiddleware' must be in MIDDLEWARE in order to use the admin application.` – simon Jun 19 '20 at 04:27
@simon which django version you're using ? – Chiheb Nexus Jun 19 '20 at 05:51
1

3.0 -- must be a new thing, I suppose. – simon Jun 19 '20 at 06:12
Ah! i'll check this code against v3 and i'll update my post. Thanks for pointing it out. – Chiheb Nexus Jun 19 '20 at 18:21

score -1 · Answer 6 · answered Jun 26 '20 at 11:36

-1

For all using Django 3.0,

comment out this code AUTH_USER_MODEL = 'customUser' in your settings.py and create a superuser (python manage.py createsuperuser) with the default user model first.

After creating the superuser then uncomment this code AUTH_USER_MODEL = 'customUser'.

This happened to me and that's what I did with Django 3.0

You should be good to go. Hope it helps

answered Jun 26 '20 at 11:36

Qcophie

9
1

1

not recommended at all, this will lead to two user model at one time. this can lead to great inconsistencies as you scale up. I HIGHLY SUGGEST you refactor your code to remove that!! – emanuel sanga Sep 11 '21 at 21:07

Django Admin without Authentication

6 Answers6

The accepted answer adapted for Django version >= 1.10

Linked