Question

I’m using a user profile model with a ForeignKey to the User, authenticated by django.contrib.auth.

The same auth module is of course used for the admin interface, so if a superuser/staff member is logged in to the admin interface, and enters the main site, the site will accept session cookie and authenticate him. This creates a problem because a superuser/admin doesn’t need to have a UserProfile and shouldn’t be recognized by the main site.

What’s the easiest way to solve this, so that the sessions from admin don’t carry on to the site?

Answer 1

From a design standpoint your idea seems like a bit of a hack, but if you really want to do this you may use a middleware.

class MyMiddleware(object):
    def process_request(self, request):
        if request.user.is_authenticated:
            try:
                UserProfile.objects.get(user=request.user)
            except UserProfile.DoesNotExist:
                from django.contrib.auth.models import AnonymousUser
                request.user = request._cached_user = AnonymousUser()
        return None

This should be at the top of the middleware list to prevent possible side-effects.