Authentication

Time Capsule uses Django's built-in authentication system for secure user management.

User Registration

New users can register with:

• Username - Unique identifier
• Email - For account recovery and notifications
• Password - Securely hashed using Django's password hashers

Registration Process

1. Navigate to /register/
2. Fill out the registration form
3. Submit the form
4. Redirected to login page on success

Login

Registered users can log in with:

• Username
• Password

Login Process

1. Navigate to /login/
2. Enter credentials
3. Submit the form
4. Redirected to dashboard on success

Session Management

• Sessions are managed by Django
• Users remain logged in across page visits
• Logout functionality available
• Session timeout configurable in settings

Security Features

Password Security

• Minimum length requirements
• Complexity validation
• Secure hashing (PBKDF2-SHA256)
• Protection against common passwords

Authentication Protection

• CSRF tokens on all forms
• Session hijacking prevention
• Secure cookie settings
• Login required decorators

Protected Routes

The following routes require authentication:

@login_required
- /dashboard/
- /capsule_create/
- /capsule_detail/<id>/
- /capsule_delete/<id>/

Attempting to access these without login redirects to the login page.

Admin Authentication

Admin users have additional privileges:

• Access to Django admin panel
• Manual email sending
• Email testing interface
• Full database access

Admin Check

@user_passes_test(is_admin)
def admin_only_view(request):
    # Only superusers can access
    pass

User Model

Time Capsule uses Django's default User model:

from django.contrib.auth.models import User

User fields:
- username
- email
- password (hashed)
- first_name
- last_name
- is_staff
- is_superuser
- date_joined

Best Practices