#28728: validate_password silently allows invalid passwords if no user instance
is
given
-------------------------------------+-------------------------------------
Reporter: Jaap Roes | Owner: nobody
Type: | Status: new
Cleanup/optimization |
Component: | Version: master
contrib.auth | Keywords: password validation
Severity: Normal | requires user
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
While implementing a user registration flow using django-rest-framework
and djoser, I noticed that not all the password validators were behaving
as expected.
In particular Django's `UserAttributeSimilarityValidator`, (which is in
the list of default validators). It turns out this is because
`validate_password` is called with just the passwords to be validate,
omitting the user instance this password is validated for.
Apparently omitting a user instance is allowed by design, the docs for
`validate_password` state:
The user object is optional: if it's not provided, some validators may
not be able to perform any validation and will accept any password.
If `validate_password` is unable to properly validate a password without
the user instance, then shouldn't that parameter be required? As it stands
now the behaviour is wholly unexpected from an end user's point of view.
Neither `validate_password` nor `UserAttributeSimilarityValidator` warn
about being unable to do their job. This makes it very easy to overlook
that some validation is not taking place.
Would adding a warning to `UserAttributeSimilarityValidator` or even a
deprecation process for calling `validate_password` without a user
instance be warranted?
--
Ticket URL: <https://code.djangoproject.com/ticket/28728>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/048.cc09ee09b57283a71a94942eff03160f%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
