django.contrib.auth: how to keep site and admin sessions separate?

Question

I'm using a user profile model with a ForeignKey to the User, authenticated by django.contrib.auth.

The same auth module is of course used for the admin interface, so if a superuser/staff member is logged in to the admin interface, and enters the main site, the site will accept session cookie and authenticate him. This creates a problem because a superuser/admin doesn't need to have a UserProfile and shouldn't be recognized by the main site.

What's the easiest way to solve this, so that the sessions from admin don't carry on to the site?

Answer 1

if request.session.get ('has_account', False):
    return HttpResponse ("You have no account, sorry.")

Then make sure, every user of your front-end gets, if his session is initiated, the value has_account set properly.

Answer 2

I dont think there is a way to solve exactly this, "What's the easiest way to solve this, so that the sessions from admin don't carry on to the site?"

But depending on what you wnat to do, you may try,

1. don't create UserProfile for superuser

if request.user.is_superuser():
UserProf.objects.create(...)

1. I always have the problem where I want to keep a logged in Admin user and a logged in normal user, simultaneously, when I am developing. To do this, I have two entries in /etc/hosts

   127.0.0.1 uswaretech.tld
   127.0.0.1 admin.uswaretech.tld

Now, normal user always logs in via uswaretech.tld and admin always via admin.uswaretech.tld so thy can both be logge din simultaneously.

Answer 3

From a design standpoint your idea seems like a bit of a hack, but if you really want to do this you may use a middleware.

class MyMiddleware(object):
    def process_request(self, request):
        if request.user.is_authenticated:
            try:
                UserProfile.objects.get(user=request.user)
            except UserProfile.DoesNotExist:
                from django.contrib.auth.models import AnonymousUser
                request.user = request._cached_user = AnonymousUser()
        return None

This should be at the top of the middleware list to prevent possible side-effects.