title: Best way to make Django's login_required the default
body: <p>I'm working on a large Django app, the vast majority of which requires a login to access.  This means that all throughout our app we've sprinkled:</p>
  
  <pre><code>@login_required
  def view(...):
  </code></pre>
  
  <p>That's fine, and it works great <em>as long as we remember to add it everywhere</em>!  Sadly sometimes we forget, and the failure often isn't terribly evident.  If the only link to a view is on a @login_required page then you're not likely to notice that you can actually reach that view without logging in.  But the bad guys might notice, which is a problem.</p>
  
  <p>My idea was to reverse the system.  Instead of having to type @login_required everywhere, instead I'd have something like:</p>
  
  <pre><code>@public
  def public_view(...):
  </code></pre>
  
  <p>Just for the public stuff.  I tried to implement this with some middleware and I couldn't seem to get it to work.  Everything I tried interacted badly with other middleware we're using, I think.  Next up I tried writing something to traverse the URL patterns to check that everything that's not @public was marked @login_required - at least then we'd get a quick error if we forgot something.  But then I couldn't figure out how to tell if @login_required had been applied to a view...</p>
  
  <p>So, what's the right way to do this?  Thanks for the help!</p>