将django密码验证器与django rest框架集成validate_password

Question

我试图集成django验证器1.9与django rest框架序列化器。但是序列化的用户（django rest框架）与django验证器不兼容。

下面是序列化程序。派克

import django.contrib.auth.password_validation as validators
from rest_framework import serializers

    class RegisterUserSerializer(serializers.ModelSerializer):

        password = serializers.CharField(style={'input_type': 'password'}, write_only=True)

        class Meta:
            model = User
            fields = ('id', 'username', 'email, 'password')

        def validate_password(self, data):
            validators.validate_password(password=data, user=User)
            return data

        def create(self, validated_data):
            user = User.objects.create_user(**validated_data)
            user.is_active = False
            user.save()
            return user

我设法使MinimumLengthValidator和NumericPasswordValidator正确，因为这两个函数validate在验证时都不使用“user”。源代码在这里

摘自django源代码：

def validate(self, password, user=None):
        if password.isdigit():
            raise ValidationError(
                _("This password is entirely numeric."),
                code='password_entirely_numeric',
            )

对于其他验证器，如UserAttributeSimilarityValidator，该函数在验证时使用另一个参数“user”（“user”是django用户模型，如果我没有错的话）

摘自django源代码：

 def validate(self, password, user=None):
        if not user:
            return

        for attribute_name in self.user_attributes:
            value = getattr(user, attribute_name, None)

如何将序列化用户更改为django验证器（UserAttributeSimilarityValidator）可以看到的内容

摘自django源代码：

def validate(self, password, user=None):
        if not user:
            return

        for attribute_name in self.user_attributes:
            value = getattr(user, attribute_name, None)
            if not value or not isinstance(value, string_types):
                continue

编辑

Django Rest Framework可以获得所有Django内置的密码验证（但这就像黑客攻击）。这里有一个问题：

验证错误是这样的

此密码太短。它必须包含至少8个字符。]），ValidationError（['此密码完全是数字。']）]

验证不包含字段。Django rest框架将其视为

{
    "non_field_errors": [
        "This password is too short. It must contain at least 8 characters.",
        "This password is entirely numeric."
    ]
}

如何在raisevalidationerror

Answer 1

使用序列化程序！使用validate\u fieldname方法！

class UserSerializer(serializers.ModelSerializer):

    class Meta:
        model = User
        fields = (
            'id', 'username', 'password', 'first_name', 'last_name', 'email'
        )
        extra_kwargs = {
            'password': {'write_only': True},
            'username': {'read_only': True}
        }

    def validate_password(self, value):
        try:
            validate_password(value)
        except ValidationError as exc:
            raise serializers.ValidationError(str(exc))
        return value

    def create(self, validated_data):
        user = super().create(validated_data)
        user.set_password(validated_data['password'])

        user.is_active = False
        user.save()
        return user

    def update(self, instance, validated_data):
        user = super().update(instance, validated_data)
        if 'password' in validated_data:
            user.set_password(validated_data['password'])
            user.save()
        return user

Answer 2

您可以通过self访问用户对象。实例，即使在执行字段级验证时也是如此。像这样的方法应该会奏效：

 from django.contrib.auth import password_validation

 def validate_password(self, value):
    password_validation.validate_password(value, self.instance)
    return value

Answer 3

就像您提到的，当您使用用户属性相似验证器验证validate_password方法中的密码时，您没有用户对象。

我的建议是，您应该通过在序列化器上实现valester方法来执行对象级验证，而不是执行字段级验证：

import sys
from django.core import exceptions
import django.contrib.auth.password_validation as validators

class RegisterUserSerializer(serializers.ModelSerializer):

     # rest of the code

     def validate(self, data):
         # here data has all the fields which have validated values
         # so we can create a User instance out of it
         user = User(**data)

         # get the password from the data
         password = data.get('password')

         errors = dict() 
         try:
             # validate the password and catch the exception
             validators.validate_password(password=password, user=User)

         # the exception raised here is different than serializers.ValidationError
         except exceptions.ValidationError as e:
             errors['password'] = list(e.messages)

         if errors:
             raise serializers.ValidationError(errors)

         return super(RegisterUserSerializer, self).validate(data)