hahaha you're right! we've just setup the ^[a-zA-Z0-9_.-]+$ regex for both username and password. Thanks for the pen-testing
Do you really want that regex for passwords also? Am I not allowed to put interesting characters in my password?
Not sure this is ideal either, it rejected the first password my password manager generated. Password should probably just be anything other than all whitespace, no? Maybe a length requirement.
Sorry guys, do you like ^[A-Za-z0-9@#$%^&+=]+$ for your passwords?
You should not regex check your passwords at all. Just check !="" and maybe check the length
There is no reason why you should limit symbols for passwords.
This times 1000. Why would you regex check your password? Check for empty string and length and be done with it.
You are right. Django default auth backend handles this perfectly, but we wanted that functionality of login + signup in the same form, and that signup autofill in case login fail, so made our custom auth views and screw up some things (like username and password validation and going back to previous page after login)