Social Authentication & Security with Google OAuth

User onboarding must be frictionless while maintaining enterprise-grade account security. We implemented Google OAuth 2.0 Single Sign-On (SSO) alongside standard Django authentication.

1. Configuring django-allauth in Django Settings

In npmstart/settings.py, we configure the authentication backends and OAuth scopes:

INSTALLED_APPS = [
    # Django core
    'django.contrib.auth',
    'django.contrib.messages',
    # Allauth
    'allauth',
    'allauth.account',
    'allauth.socialaccount',
    'allauth.socialaccount.providers.google',
]

AUTHENTICATION_BACKENDS = [
    'django.contrib.auth.backends.ModelBackend',
    'allauth.account.auth_backends.AuthenticationBackend',
]

SOCIALACCOUNT_PROVIDERS = {
    'google': {
        'SCOPE': ['profile', 'email'],
        'APP': {
            'client_id': os.environ['CLIENT_ID'],
            'secret': os.environ['CLIENT_SECRET'],
        },
        'AUTH_PARAMS': {
            'access_type': 'online',
        },
    }
}

SOCIALACCOUNT_LOGIN_ON_GET = True
SOCIALACCOUNT_AUTO_SIGNUP = True
SOCIALACCOUNT_EMAIL_VERIFICATION = 'none'
LOGIN_REDIRECT_URL = '/'
LOGOUT_REDIRECT_URL = '/'

2. Google OAuth Callback Architecture

When a user clicks Login with Google:

[User Browser]
       │
       ▼  GET /accounts/google/login/
[Django Allauth]
       │
       ▼  Redirects to accounts.google.com
[Google OAuth Consent Screen]
       │
       ▼  Redirects back with auth code to /accounts/google/login/callback/
[Django Backend validates token with Google]
       │
       ▼  Creates/links User & Profile, sets Django session cookie
[User Dashboard / Home]

3. reCAPTCHA v2 Bot Defense

To prevent bot spam on user registration and comment forms, we integrate django-recaptcha:

from django_recaptcha.fields import ReCaptchaField
from django_recaptcha.widgets import ReCaptchaV2Checkbox

class CustomUserRegistrationForm(forms.ModelForm):
    captcha = ReCaptchaField(widget=ReCaptchaV2Checkbox)

    class Meta:
        model = User
        fields = ['username', 'email', 'password']

This guarantees 100% human-verified engagement across all community touchpoints.