Anyone know a better way do write this login function in django

Question

Hay I was wondering if anyone knew a better way to do this.

def login_user(request):
    username = request.POST.get('username')
    password = request.POST.get('password')

    user = User.objects.filter(username=username)

    if user:
        user = user[0]
        if user.password == generate_password(password):
            return HttpResponse("password fine")
        else:
            return HttpResponse("password incorrect")
    else:
        return HttpResponse("no user found by that username")

and the generate_password function is just

generate_password(string):
    return hashlib.sha224(str(string)).hexdigest()

Any ideas would be great.

Thanks

Answer 1

Why don't use Django auth default views ?

Answer 2

the only amelioration i see is use get instead of filter (it will save you one line)

user = User.objects.get(username=username)

Answer 3

Looking at the level of control you want to have, you'll want to make use of the authenticate and maybe login functions in django.contrib.auth. These are the main functions for accessing authentication. I should stress that you really, really should use these instead of finding the user and checking the password hash manually. There are a number of reasons why:

• they will make use of whatever authentication backend you or someone else in the future have installed
• your version will be far less tested than Django's and is more likely to open security holes
• it's quicker, shorter, more flexible and more readable
• Django's auth app will probably change in the near future, sticking to authenticate will help you migrate to the new auth app when it gets written/committed/released

If you do want to rewrite the way a user is found and authenticated, write your own Authenticate backend, which will be used when you call authentication (even in someone else's app, like the admin). This is the only place you should rewrite authentication in Django.

The following examples are from the Django auth docs.

1. Checking a user's password:

from django.contrib.auth import authenticate
user = authenticate(username='john', password='secret')
if user is not None:
    if user.is_active:
        print "You provided a correct username and password!"
    else:
        print "Your account has been disabled!"
else:
    print "Your username and password were incorrect."

2. Custom authentication backend:

Here is a backend that uses the same authenticate method as Django's, which you can find at django.contrib.auth.backends.ModelBackend:

from django.contrib.auth.models import User

class MyBackend:
  def authenticate(self, username=None, password=None):
    try:
      user = User.objects.get(username=username)
      if user.check_password(password):
        return user
    except User.DoesNotExist:
      return None

  def get_user(self, user_id):
    try:
      return User.objects.get(pk=user_id)
    except User.DoesNotExist:
      return None

Answer 4

You should download django-registration and go through the code. It manages everything for you, including cleaning the code. Your original code will not handle empty submissions.

http://bitbucket.org/ubernostrum/django-registration/