Implementing authorization

We have implemented authentication where we allow users to sign up and log in. But we also need authorization that authorizes access to certain pages only to logged-in users.

Currently, if a user manually enters the URL to create a review – for example, http://localhost:8000/movie/2/create – they can still access the form. We should authorize access to creating/updating/deleting reviews only to logged-in users. We will also authorize access to logout.

Let's look at the steps to do so:

1. We import and add the @login_required decorator to the views that we want to authorize, as shown in bold:

/movie/views.py

…
from .forms import ReviewForm
from django.contrib.auth.decorators import 
  login_required
…
@login_required
def createreview(request, movie_id):
    …
@login_required
def updatereview(request, review_id):
    …
@login_required
def deletereview...