#24987: django.test.client.Client.login() rejects user with is_active=False
-----------------------------------+--------------------
Reporter: jdufresne | Owner: nobody
Type: Bug | Status: new
Component: Testing framework | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-----------------------------------+--------------------
According to the documentation on the `User` attribute `is_active`:
https://docs.djangoproject.com/en/dev/ref/contrib/auth/
> This doesn’t necessarily control whether or not the user can log in.
Authentication backends aren’t required to check for the is_active flag,
and the default backends do not. If you want to reject a login based on
is_active being False, it’s up to you to check that in your own login view
or a custom authentication backend. However, the AuthenticationForm used
by the login() view (which is the default) does perform this check, as do
the permission-checking methods such as has_perm() and the authentication
in the Django admin. All of those functions/methods will return False for
inactive users.
My auth system takes advantage of this by allowing inactive user to login.
However, if I try to login an inactive user in a test, the login fails.
This happens due to the code in Client.login() in client.py:
{{{
user = authenticate(**credentials)
if (user and user.is_active and
apps.is_installed('django.contrib.sessions')):
...
return True
else:
return False
}}}
That is, after a successful authentication in a test, inactive users are
rejected. This seems to contradict the documentation.
How would you feel about dropping the `user.is_active` check in
`Client.login()`?
--
Ticket URL: <https://code.djangoproject.com/ticket/24987>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/052.64bdaff5825f564f282e338c2e7e1b5e%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
