Django - redirect to login page against 403

Question

Why does Django redirect the user to the login page when trying to access permission protected pages? Doesn't it make sense to raise 403? Then I could display a meaningful message in a 403.html file (using custom middleware) so that the user says that they do not have permissions to perform the action. Also, I could identify links to views that the user should not even represent in the first place or to users trying to access forbidden resources.

Answer 1

If you are talking about the login_required decorator, there is no reason why you should use this. You can write a similar decorator that did what you need (return 403 answer).

Unfortunately, the login_required decorator code is actually a bit complicated, so it would not be easy to copy or modify for your needs, as part of the redirection is actually in the user_passes_test function that they use.

Answer 2

For future Googlers, the permission_required decorator accepts an optional raise_exception keyword argument, which will include 403 if the user does not have the appropriate permission.