User Model & Permissions0%
Groups and Roles

User Model & Permissions

Beginner12 min read•Updated: Jul 11, 2026
Study MaterialsCheatsheet

User Model & Permissions

User authentication and authorization are mission-critical for web platforms. While Django ships with a default User model, production architectures strongly advise configuring a Custom User Model at the inception of a project. This allows you to use email addresses as unique login identifiers, add custom enterprise fields, and manage fine-grained permissions.

1. Why You MUST Use a Custom User Model

Django's default auth.User uses username for logins and has fixed fields (first_name, last_name, email). Altering the user model mid-project requires complex, risky database migrations across foreign keys.

By defining a custom user model inheriting from AbstractUser on Day 1, you preserve total freedom to extend user attributes throughout the application lifetime:

Python
# accounts/models.py
from django.contrib.auth.models import AbstractUser
from django.db import models
 
class CustomUser(AbstractUser):
# Enforce unique email address as primary login identifier
email = models.EmailField(unique=True)
# Custom business attributes
bio = models.TextField(blank=True)
company_name = models.CharField(max_length=100, blank=True)
is_verified = models.BooleanField(default=False)
avatar = models.ImageField(upload_to="avatars/", null=True, blank=True)
 
# Use email instead of username for authentication
USERNAME_FIELD = "email"
REQUIRED_FIELDS = ["username"] # Fields prompted during createsuperuser
 
def __str__(self):
return self.email

2. Registering AUTH_USER_MODEL in Settings

Inform Django to use your custom model globally:

Python
# config/settings.py
AUTH_USER_MODEL = "accounts.CustomUser"

When referencing the user model across your codebase:

  • In models.py foreign keys: use settings.AUTH_USER_MODEL
  • In view code: use get_user_model()
Python
# In models.py:
author = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
 
# In views.py:
from django.contrib.auth import get_user_model
User = get_user_model()

3. Django Permissions Framework

Django models automatically generate four default permissions upon creation:

  1. 1
    add_<modelname> (e.g. articles.add_article)
  2. 2
    change_<modelname> (e.g. articles.change_article)
  3. 3
    delete_<modelname> (e.g. articles.delete_article)
  4. 4
    view_<modelname> (e.g. articles.view_article)

Checking Permissions Programmatically

Python
# Check permission on a user instance
if user.has_perm("articles.delete_article"):
print("User is authorized to delete this article")

Guarding Views with @permission_required

Python
from django.contrib.auth.decorators import permission_required
 
@permission_required("articles.delete_article", raise_exception=True)
def delete_article_view(request, article_id):
# Only users with explicit delete permissions can execute this view!
...
Interactive Quiz

Practice Quiz

Question 1
Why does Django's official documentation recommend creating a Custom User Model at the very beginning of a new project?
Question 2
What setting in settings.py tells Django to adopt your custom user model?
Question 3
How should you reference the User model when defining ForeignKey relationships in other models?
Question 4
What four permissions does Django automatically generate for every registered database model?
Question 5
How do you configure a custom user model to log in using an email address instead of a username?
Next Lesson

Groups and Roles

Continue learning with hands-on practice, examples, and exercises in the upcoming topic.

Related Lessons

Previous LessonNext Lesson
Django Admin SiteGroups and Roles

Practice Quiz

Test your understanding of this lesson with 5 questions. Each question has one correct answer.

PreviousNext
PrevNext