#28645: AuthenticationForm's inactive user error isn't raised when using
ModelBackend
-------------------------------------+-------------------------------------
Reporter: Guilherme Junqueira | Owner:
| shangdahao
Type: Bug | Status: new
Component: contrib.auth | Version: 1.11
Severity: Normal | Resolution:
Keywords: 2.1 | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Tim Graham):
* keywords: => 2.1
* status: closed => new
* has_patch: 1 => 0
* resolution: fixed =>
Comment:
Reopening since the fix had to be reverted. We'll try to develop a
solution for Django 2.1. Probably the solution will be too invasive to
backport to the stable branches.
In a mail to the security mailing list, Jack Cushman suggested:
It's desirable for auth backends to enforce rules like “no inactive
users” when supplied with otherwise-correct credentials – that’s more of a
backend concern than a display concern, and forms shouldn’t be required to
enforce it. But it is desirable for auth forms to show custom error
messages when an auth backend rejects a user, if and only if the user
supplied correct credentials. The ideal way to solve both problems would
be for auth backends to return a tuple of `(user or None,
custom_error_code or None)`, but that would break backwards compatibility.
\\ \\
So, can we let auth backends return custom error codes with backwards
compatibility? \\ \\
Attached is an untested patch that hopefully does that, by adding an
authenticate_with_error_code method that backends can optionally implement
and forms can optionally consume. I think this is a good angle on the
problem – it cleans up the can of worms with displaying custom errors, and
also totally avoids dealing with attacker-submitted data after credentials
fail to validate, which is key to avoiding any subtle security issues.
I'll attach the patch, but I haven't evaluated it in much detail.
--
Ticket URL: <https://code.djangoproject.com/ticket/28645#comment:12>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/068.2f5d8c91ff72bd94a0e9c26a5141a74e%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
