fakr

Exactly, it saves a lot of time when you want a cookie-cutter site using lots of 3rd party apps. Not knocking that - there are lots of cases where that's exactly what you need. But this is what reminds me more of a CMS like Drupal than a framework - blocks of content managed by a single admin and authentication system.

When I want to do something more original and specific where I don't need all those apps, Django just gets in the way - and that's when I turn to a more lightweight and flexible framework.

Use the best tool for the job. Sometimes Django is that tool. The problem I have is with companies and individuals who think it's the only tool.

Authentication is something in my experience that is specific to an individual project. I don't want to be told what database schema I must use to store my user data - that's a specific project requirement (unless I'm building a cookie-cutter site, which Django is good at, as I've stated).

So what do I want ? For authentication there are some common requirements:

- session/cookie management to store a user ID (or other info)

- hooks/middleware/whatever to allow me to check user credentials on each request

- safe hashing/encryption of passwords

- form processing/validation

- integration with OpenID, oAuth, LDAP etc

If a framework, or libraries, provide these then that saves a lot of time and effort, and allows me to create a tailor-made solution.

You completely missed my points:

1. The framework should not define your data model.

2. Many 3rd party apps depend on the existing User and other auth models.

The real issue I have with Django - and extensions such as comments - is that in some ways it feels like a CMS masquerading as a framework.

Take for example contrib.auth - it defines User, Group and Permission models for you. Frequently this is an issue - what if I don't want a username of 30 characters ? What if I want OpenID authentication instead ?

Sure, you can override this but then you find that a whole lot of 3rd party apps - comments, admin etc - rely on these models, which in turn depend on lower-level functionality such as the ORM or templates. The very fact that you have a framework telling you what your data model should look like just feels "wrong".

Does this mean that you shouldn't use Django ? Absolutely not, there are many projects suited to Django - especially content sites where you are putting together large building blocks with some homemade glue. But I've found it more trouble than worth for smaller projects, or where you have very specific requirements - in these cases (assuming you want to stay in Python) - I'd recommend Flask or Pylons.

Unfortunately Django has become the new Blub framework for Python web development, which means it's used by companies by default, rather than being a useful but limited tool in the toolbox.