class AuthenticationMiddleware(object):
  def process_request(self, request):
    assert hasattr(request, 'session'), (
      "The Django authentication middleware requires session middleware "
      "to be installed. Edit your MIDDLEWARE_CLASSES setting to insert "
      "'django.contrib.sessions.middleware.SessionMiddleware' before "
      "'django.contrib.auth.middleware.AuthenticationMiddleware'."
    )
    request.user = SimpleLazyObject(lambda: get_user(request))

class SessionAuthenticationMiddleware(object):
  """
  Middleware for invalidating a user's sessions that don't correspond to the
  user's current session authentication hash (generated based on the user's
  password for AbstractUser).
  """
  def process_request(self, request):
    user = request.user
    if user and hasattr(user, 'get_session_auth_hash'):
      session_hash = request.session.get(auth.HASH_SESSION_KEY)
      session_hash_verified = session_hash and constant_time_compare(
        session_hash,
        user.get_session_auth_hash()
      )
      if not session_hash_verified:
        auth.logout(request)

def get_user(request):
  if not hasattr(request, '_cached_user'):
    request._cached_user = auth.get_user(request)
  return request._cached_user

def get_user(request):
  """
  Returns the user model instance associated with the given request session.
  If no user is retrieved an instance of `AnonymousUser` is returned.
  """
  from .models import AnonymousUser
  user = None
  try:
    user_id = request.session[SESSION_KEY]
    backend_path = request.session[BACKEND_SESSION_KEY]
  except KeyError:
    pass
  else:
    if backend_path in settings.AUTHENTICATION_BACKENDS:
      backend = load_backend(backend_path)
      user = backend.get_user(user_id)
  return user or AnonymousUser()

def login(request, user):
  """
  Persist a user id and a backend in the request. This way a user doesn't
  have to reauthenticate on every request. Note that data set during
  the anonymous session is retained when the user logs in.
  """
  session_auth_hash = ''
  if user is None:
    user = request.user
  if hasattr(user, 'get_session_auth_hash'):
    session_auth_hash = user.get_session_auth_hash()

  if SESSION_KEY in request.session:
    if request.session[SESSION_KEY] != user.pk or (
        session_auth_hash and
        request.session.get(HASH_SESSION_KEY) != session_auth_hash):
      # To avoid reusing another user's session, create a new, empty
      # session if the existing session corresponds to a different
      # authenticated user.
      request.session.flush()
  else:
    request.session.cycle_key()
  request.session[SESSION_KEY] = user.pk
  request.session[BACKEND_SESSION_KEY] = user.backend
  request.session[HASH_SESSION_KEY] = session_auth_hash
  if hasattr(request, 'user'):
    request.user = user
  rotate_token(request)

from django.contrib.auth import authenticate, login 
def login_view(request):
  username = request.POST['username']
  password = request.POST['password']
  user = authenticate(username=username, password=password)
  if user is not None:
    login(request, user)
    # 轉到成功頁面
  else:    # 返回錯誤信息

def authenticate(**credentials):
  """
  If the given credentials are valid, return a User object.
  """
  for backend in get_backends():
    try:
      inspect.getcallargs(backend.authenticate, **credentials)
    except TypeError:
      # This backend doesn't accept these credentials as arguments. Try the next one.
      continue

    try:
      user = backend.authenticate(**credentials)
    except PermissionDenied:
      # This backend says to stop in our tracks - this user should not be allowed in at all.
      return None
    if user is None:
      continue
    # Annotate the user object with the path of the backend.
    user.backend = "%s.%s" % (backend.__module__, backend.__class__.__name__)
    return user

  # The credentials supplied are invalid to all backends, fire signal
  user_login_failed.send(sender=__name__,
      credentials=_clean_credentials(credentials))

def my_view(request):
  if request.user.is_authenticated():
    # 認證的用戶
  else:  
    # 匿名用戶