djangovalidationdjango-rest-framework

integrate django password validators with django rest framework validate_password


I'm trying to integrate django validators 1.9 with django rest framework serializers. But the serialized 'user' (of django rest framework) is not compatible with the django validators.

Here is the serializers.py

import django.contrib.auth.password_validation as validators
from rest_framework import serializers

    class RegisterUserSerializer(serializers.ModelSerializer):

        password = serializers.CharField(style={'input_type': 'password'}, write_only=True)

        class Meta:
            model = User
            fields = ('id', 'username', 'email, 'password')

        def validate_password(self, data):
            validators.validate_password(password=data, user=User)
            return data

        def create(self, validated_data):
            user = User.objects.create_user(**validated_data)
            user.is_active = False
            user.save()
            return user

I managed to get MinimumLengthValidator and NumericPasswordValidator correct because both function validate don't use 'user' in validating. Source code is here

Excerpt from django source code:

def validate(self, password, user=None):
        if password.isdigit():
            raise ValidationError(
                _("This password is entirely numeric."),
                code='password_entirely_numeric',
            )

For other validators like UserAttributeSimilarityValidator, the function uses another one argument 'user' in validating ('user' is django User model, if I'm not wrong)

Excerpt from django source code:

 def validate(self, password, user=None):
        if not user:
            return

        for attribute_name in self.user_attributes:
            value = getattr(user, attribute_name, None)

How can I change serialized User into what django validators(UserAttributeSimilarityValidator) can see

Excerpt from django source code:

def validate(self, password, user=None):
        if not user:
            return

        for attribute_name in self.user_attributes:
            value = getattr(user, attribute_name, None)
            if not value or not isinstance(value, string_types):
                continue

Edit

Django Rest Framework can get all of Django's built-in password validation (but it's like a hack). Here's a problem:

The validationError is like this

[ValidationError(['This password is too short. It must contain at least 8 characters.']), ValidationError(['This password is entirely numeric.'])]

The validation doesn't contain a field. Django rest framework see it as

{
    "non_field_errors": [
        "This password is too short. It must contain at least 8 characters.",
        "This password is entirely numeric."
    ]
}

How can I inject a field at raise ValidationError


Solution

  • Like you mentioned, when you validate the password in validate_password method using UserAttributeSimilarityValidator validator, you don't have the user object.

    What I suggest that instead of doing field-level validation, you shall perform object-level validation by implementing validate method on the serializer:

    import sys
    from django.core import exceptions
    import django.contrib.auth.password_validation as validators
    
    class RegisterUserSerializer(serializers.ModelSerializer):
    
         # rest of the code
    
         def validate(self, data):
             # here data has all the fields which have validated values
             # so we can create a User instance out of it
             user = User(**data)
             
             # get the password from the data
             password = data.get('password')
             
             errors = dict() 
             try:
                 # validate the password and catch the exception
                 validators.validate_password(password=password, user=user)
             
             # the exception raised here is different than serializers.ValidationError
             except exceptions.ValidationError as e:
                 errors['password'] = list(e.messages)
             
             if errors:
                 raise serializers.ValidationError(errors)
              
             return super(RegisterUserSerializer, self).validate(data)