Hacker News Reader

Comment by jsmeaton | Hacker News Reader

Unfortunately it looks like you hit a bit of a sore spot with regards to django auth. There isn't a good out of the box solution for email based usernames. There are patterns available, and the "swappable" user framework is there to allow email based usernames. But an email based model isn't available. I'm fairly sure there are tickets or ideas to make this happen, but we're not there yet.

Django really is quick and easy to get going though. If you can make your way past the email based usernames, I think you'd find a really capable and easy system waiting for you.

View on HN

One can use Custom User Models for things like email logins. I've done this in a few projects and it works great. More info: https://docs.djangoproject.com/en/1.8/topics/auth/customizin...

I think a bigger issue with regards to usernames and email is the fact that neither are titlecased before getting indexed. I get that there are certain legacy considerations or whatever, but it really seems like there should at least be a note in the documentation about this given the massive clusterfuck that would potentially ensue should someone not figure this out before launching.

Do you mean that usernames/emails aren't normalised to a single case to prevent "duplicates" of "jarshwah" and "Jarshwah"? If so, this was recently brought up on the mailing list: https://groups.google.com/forum/#!topic/django-developers/SW...

I agree this should probably have a solution or at least documentation to be wary of.

Yeah, I actually hadn't seen that, but I know there are also longstanding tickets for this. I actually don't like the solutions in those threads, I think better to just add an extra field to the models, so have something like 'db_email' and 'display_email'. I realize you can do this with a functional index or whatever, but I think that's actually kind of hacky given the lack of ORM support for functional indexes.

My big issue with the current state though is that if you're relying on usernames or email addresses being unique then you're potentially opening yourself up to all sorts of security issues without realizing it.

FWIW I agree the solutions in that thread aren't good enough, especially since most of them are postgres specific. Now that migrations can be shipped with contrib.auth, a better solution might be possible.

I'd probably prefer a functional unique index since it would be easier to maintain (rather than duplicate fields). We just need to get expression support into indexes.

Well, I hear there's this expressions API and that now it's possible to use them during the initial creation/save of an object... maybe there's some normalization people could do with that :)

Do you know how well cookiecutter-django [0] handles email logins? I've been meaning to play around with cookiecutter, but I haven't started a new project recently. Cookiecutter uses django-allauth [1], which seems to offer email login methods, from what I see in a cursory look at the docs [2].

[0] - https://github.com/pydanny/cookiecutter-django

[1] - https://github.com/pennersr/django-allauth

[2] - http://django-allauth.readthedocs.org/en/latest/configuratio...

I asked pydanny on twitter and he says yes, thanks to django-allauth. Requires a setting in your settings.py file and it should just work.

It's comforting to know that I'm not the only one who struggled to get email-based authentication working in Django. It had me feeling totally incompentent a few weeks ago and I ended up implementing something very hackish to set the username equal to the email address.

Reply on news.ycombinator.com