Is request.user safe?

Question

Django

Good afternoon.
The whole point is in the name - how much can you trust the value of request.user?

if object.owner == request.user:
        object.delete()

If I do such a check before deleting an object, is this enough to protect against evil hackers or can this value be changed?

Answer 1

Read how the user's cookie is formed - if it is vulnerable, then spoofing is possible
In the current implementation, the problem is on the side of the http protocol, and not on the jung side
In the current implementation, spoofing is possible if an attacker stole the cookie from a legitimate user