django - 将 django 密码验证器与 django rest 框架 validate_password 集成

Question

我正在尝试集成 django validators 1.9 带有 django rest 框架序列化程序。但是序列化的“用户”(django rest 框架)与 django 验证器不兼容。

这是serializers.py

import django.contrib.auth.password_validation as validators
from rest_framework import serializers

    class RegisterUserSerializer(serializers.ModelSerializer):

        password = serializers.CharField(style={'input_type': 'password'}, write_only=True)

        class Meta:
            model = User
            fields = ('id', 'username', 'email, 'password')

        def validate_password(self, data):
            validators.validate_password(password=data, user=User)
            return data

        def create(self, validated_data):
            user = User.objects.create_user(**validated_data)
            user.is_active = False
            user.save()
            return user

我设法让 MinimumLengthValidator 和 NumericPasswordValidator 正确，因为这两个函数 validate 都没有在验证中使用“用户”。源代码是 here

摘自 django 源代码:

def validate(self, password, user=None):
        if password.isdigit():
            raise ValidationError(
                _("This password is entirely numeric."),
                code='password_entirely_numeric',
            )

对于像 UserAttributeSimilarityValidator 这样的其他验证器，该函数在验证中使用另一个参数“用户”(“用户”是 django 用户模型，如果我没记错的话)

摘自 django 源代码:

 def validate(self, password, user=None):
        if not user:
            return

        for attribute_name in self.user_attributes:
            value = getattr(user, attribute_name, None)

如何将序列化的用户更改为 django 验证器(UserAttributeSimilarityValidator)可以看到的

摘自 django 源代码:

def validate(self, password, user=None):
        if not user:
            return

        for attribute_name in self.user_attributes:
            value = getattr(user, attribute_name, None)
            if not value or not isinstance(value, string_types):
                continue

编辑

Django Rest Framework 可以获得 Django 的所有内置密码验证(但它就像一个 hack)。这里有一个问题:

验证错误是这样的

[ValidationError(['This password is too short. It must contain at least 8 characters.']), ValidationError(['This password is entirely numeric.'])]

验证不包含字段。 Django rest 框架将其视为

{
    "non_field_errors": [
        "This password is too short. It must contain at least 8 characters.",
        "This password is entirely numeric."
    ]
}

如何在 raise ValidationError 处注入(inject)字段

Answer 1

就像您提到的，当您验证 password在 validate_password使用 UserAttributeSimilarityValidator 的方法验证器，您没有 user目的。
我建议不要进行字段级验证，而应执行 object-level validation通过实现 validate序列化器上的方法:

import sys
from django.core import exceptions
import django.contrib.auth.password_validation as validators

class RegisterUserSerializer(serializers.ModelSerializer):

     # rest of the code

     def validate(self, data):
         # here data has all the fields which have validated values
         # so we can create a User instance out of it
         user = User(**data)
         
         # get the password from the data
         password = data.get('password')
         
         errors = dict() 
         try:
             # validate the password and catch the exception
             validators.validate_password(password=password, user=user)
         
         # the exception raised here is different than serializers.ValidationError
         except exceptions.ValidationError as e:
             errors['password'] = list(e.messages)
         
         if errors:
             raise serializers.ValidationError(errors)
          
         return super(RegisterUserSerializer, self).validate(data)