Skip to main content

User authentication in Tornado

User Authentication in Tornado

User authentication is a vital part of securing any web application, including those built using Tornado. In this tutorial, we'll learn about implementing basic user authentication in a Tornado web application.

What is User Authentication?​

User authentication is the process of verifying the identity of a user trying to gain access to a particular system.

User Authentication Process in Tornado​

Tornado has a built-in mechanism for user authentication. Here are the steps to implement it:

1. Enable User Authentication​

First, enable user authentication by adding the following method to your request handler:

def get_current_user(self):
    return self.get_secure_cookie("user")

This method will return the current user if they are authenticated, or None otherwise.

2. Secure a Request Handler​

To restrict access to a particular request handler to authenticated users, add the @tornado.web.authenticated decorator above the method definition:

class MainHandler(tornado.web.RequestHandler):
    @tornado.web.authenticated
    def get(self):
        ...

3. Redirect Unauthenticated Users​

By default, unauthenticated users are redirected to /login. To change this, override the login_url method in your application settings:

def get_login_url(self):
    return u"/your-login-url"

4. Implement Login and Logout Handlers​

Finally, implement handlers for login and logout. Here's a simple example:

class LoginHandler(tornado.web.RequestHandler):
    def get(self):
        self.render("login.html")

    def post(self):
        self.set_secure_cookie("user", self.get_argument("name"))
        self.redirect("/")

class LogoutHandler(tornado.web.RequestHandler):
    def get(self):
        self.clear_cookie("user")
        self.redirect("/")

Summary​

In this tutorial, we've learned how to implement basic user authentication in a Tornado web application. Remember to handle exceptions and errors to ensure your application's security and reliability. You can also extend this basic example to use more advanced authentication methods, such as OAuth or JWT.