3 ms·

Unfortunately it looks like you hit a bit of a sore spot with regards to django auth. There isn't a good out of the box solution for email based usernames. Ther

Unfortunately it looks like you hit a bit of a sore spot with regards to django auth. There isn't a good out of the box solution for email based usernames. There are patterns available, and the "swappable" user framework is there to allow email based usernames. But an email based model isn't available. I'm fairly sure there are tickets or ideas to make this happen, but we're not there yet. Django really is quick and easy to get going though. If you can make your way past the email based usernames, I think you'd find a really capable and easy system waiting for you.

iyn 11y ago
One can use Custom User Models for things like email logins. I've done this in a few projects and it works great. More info: https://docs.djangoproject.com/en/1.8/topics/auth/customizing/#substituting-a-custom-user-model https://docs.djangoproject.com/en/1.8/topics/auth/customizin...
japhyr 11y ago
Do you know how well cookiecutter-django [0] handles email logins? I've been meaning to play around with cookiecutter, but I haven't started a new project recently. Cookiecutter uses django-allauth [1], which seems to offer email login methods, from what I see in a cursory look at the docs [2]. [0] - https://github.com/pydanny/cookiecutter-django https://github.com/pydanny/cookiecutter-django [1] - https://github.com/pennersr/django-allauth https://github.com/pennersr/django-allauth [2] - http://django-allauth.readthedocs.org/en/latest/configuration.html http://django-allauth.readthedocs.org/en/latest/configuratio...
- jsmeaton 11y ago
  I asked pydanny on twitter and he says yes, thanks to django-allauth. Requires a setting in your settings.py file and it should just work.
Alex3917 11y ago
I think a bigger issue with regards to usernames and email is the fact that neither are titlecased before getting indexed. I get that there are certain legacy considerations or whatever, but it really seems like there should at least be a note in the documentation about this given the massive clusterfuck that would potentially ensue should someone not figure this out before launching.
- jsmeaton 11y ago
  Do you mean that usernames/emails aren't normalised to a single case to prevent "duplicates" of "jarshwah" and "Jarshwah"? If so, this was recently brought up on the mailing list: https://groups.google.com/forum/#!topic/django-developers/SW7_qI81G58 https://groups.google.com/forum/#!topic/django-developers/SW... I agree this should probably have a solution or at least documentation to be wary of.
  - Alex3917 11y ago
    Yeah, I actually hadn't seen that, but I know there are also longstanding tickets for this. I actually don't like the solutions in those threads, I think better to just add an extra field to the models, so have something like 'db_email' and 'display_email'. I realize you can do this with a functional index or whatever, but I think that's actually kind of hacky given the lack of ORM support for functional indexes. My big issue with the current state though is that if you're relying on usernames or email addresses being unique then you're potentially opening yourself up to all sorts of security issues without realizing it.
    - jsmeaton 11y ago
      FWIW I agree the solutions in that thread aren't good enough, especially since most of them are postgres specific. Now that migrations can be shipped with contrib.auth, a better solution might be possible. I'd probably prefer a functional unique index since it would be easier to maintain (rather than duplicate fields). We just need to get expression support into indexes.
      - ubernostrum 11y ago
        Well, I hear there's this expressions API and that now it's possible to use them during the initial creation/save of an object... maybe there's some normalization people could do with that :)
uououuttt 11y ago
It's comforting to know that I'm not the only one who struggled to get email-based authentication working in Django. It had me feeling totally incompentent a few weeks ago and I ended up implementing something very hackish to set the username equal to the email address.

iyn 11y ago

One can use Custom User Models for things like email logins. I've done this in a few projects and it works great. More info: https://docs.djangoproject.com/en/1.8/topics/auth/customizing/#substituting-a-custom-user-model https://docs.djangoproject.com/en/1.8/topics/auth/customizin...

japhyr 11y ago

Do you know how well cookiecutter-django [0] handles email logins? I've been meaning to play around with cookiecutter, but I haven't started a new project recently. Cookiecutter uses django-allauth [1], which seems to offer email login methods, from what I see in a cursory look at the docs [2]. [0] - https://github.com/pydanny/cookiecutter-django https://github.com/pydanny/cookiecutter-django [1] - https://github.com/pennersr/django-allauth https://github.com/pennersr/django-allauth [2] - http://django-allauth.readthedocs.org/en/latest/configuration.html http://django-allauth.readthedocs.org/en/latest/configuratio...

jsmeaton 11y ago
I asked pydanny on twitter and he says yes, thanks to django-allauth. Requires a setting in your settings.py file and it should just work.

Alex3917 11y ago

I think a bigger issue with regards to usernames and email is the fact that neither are titlecased before getting indexed. I get that there are certain legacy considerations or whatever, but it really seems like there should at least be a note in the documentation about this given the massive clusterfuck that would potentially ensue should someone not figure this out before launching.

jsmeaton 11y ago
Do you mean that usernames/emails aren't normalised to a single case to prevent "duplicates" of "jarshwah" and "Jarshwah"? If so, this was recently brought up on the mailing list: https://groups.google.com/forum/#!topic/django-developers/SW7_qI81G58 https://groups.google.com/forum/#!topic/django-developers/SW... I agree this should probably have a solution or at least documentation to be wary of.
- Alex3917 11y ago
  Yeah, I actually hadn't seen that, but I know there are also longstanding tickets for this. I actually don't like the solutions in those threads, I think better to just add an extra field to the models, so have something like 'db_email' and 'display_email'. I realize you can do this with a functional index or whatever, but I think that's actually kind of hacky given the lack of ORM support for functional indexes. My big issue with the current state though is that if you're relying on usernames or email addresses being unique then you're potentially opening yourself up to all sorts of security issues without realizing it.
  - jsmeaton 11y ago
    FWIW I agree the solutions in that thread aren't good enough, especially since most of them are postgres specific. Now that migrations can be shipped with contrib.auth, a better solution might be possible. I'd probably prefer a functional unique index since it would be easier to maintain (rather than duplicate fields). We just need to get expression support into indexes.
    - ubernostrum 11y ago
      Well, I hear there's this expressions API and that now it's possible to use them during the initial creation/save of an object... maybe there's some normalization people could do with that :)

uououuttt 11y ago

It's comforting to know that I'm not the only one who struggled to get email-based authentication working in Django. It had me feeling totally incompentent a few weeks ago and I ended up implementing something very hackish to set the username equal to the email address.