Inform user that email is invalid using Django's Password Reset

Question

I am using the built-in django password reset functionality. The documentation states:

If the email address provided does not exist in the system, this view won’t send an email, but the user won’t receive any error message either. This prevents information leaking to potential attackers. If you want to provide an error message in this case, you can subclass PasswordResetForm and use the password_reset_form argument.

However, in my case it's more important to show an error message when a user tries to reset using the wrong username.

I understand what I need to do but I don't know what to write in the form subclassing PasswordResetForm.

What should the form subclassing PasswordResetForm contain?

Thank you.

Just override the clean method for the username field. – Brandon Taylor Jan 01 '15 at 20:30 — Brandon Taylor, Jan 01 '15 at 20:30

Vlad Schnakovszki · Accepted Answer · 2015-01-01T21:02:43.180

23

So I finally figured it out myself. Here's my implementation:

class EmailValidationOnForgotPassword(PasswordResetForm):
    def clean_email(self):
        email = self.cleaned_data['email']
        if not User.objects.filter(email__iexact=email, is_active=True).exists():
            raise ValidationError("There is no user registered with the specified email address!")

        return email

You also need to add {'password_reset_form': EmailValidationOnForgotPassword} to urls.py. Here's an example:

url(r'^user/password/reset/$',
    'django.contrib.auth.views.password_reset',
    {'post_reset_redirect': '/user/password/reset/done/',
     'html_email_template_name': 'registration/password_reset_email.html',
     'password_reset_form': EmailValidationOnForgotPassword},
    name="password_reset"),

edited Jan 01 '15 at 21:02

answered Jan 01 '15 at 20:31

Vlad Schnakovszki

8,434
6
80
114

3

You probably want a case-insensitive match, and active users only: that's when the form doesn't send an email. Also, `exists()` would be slightly faster than `get()`, so it would be `if not User.objects.filter(email__iexact=email, is_active=True).exists(): raise ValidationError` – knbk Jan 01 '15 at 20:54
1

Excellent observations, thank you! I have updated the answer. – Vlad Schnakovszki Jan 01 '15 at 21:02
Here I raised ValidationError message in my code but it will not show in my screen :( please help me. I import ValidationError from ' from django.core.exceptions import ValidationError ' – MK Patel Jul 18 '19 at 09:48

ohlr · Answer 2 · 2019-03-14T23:38:23.143

For later versions of Django such as Django 2.1 there is a similar question with slightly modified code.

#forms.py
from django.contrib.auth.forms import PasswordResetForm

class EmailValidationOnForgotPassword(PasswordResetForm):

    def clean_email(self):
        email = self.cleaned_data['email']
        if not User.objects.filter(email__iexact=email, is_active=True).exists():
            msg = _("There is no user registered with the specified E-Mail address.")
            self.add_error('email', msg)
        return email

And

#urls.py
from accounts.forms import EmailValidationOnForgotPassword

path('accounts/password_reset/', auth_views.PasswordResetView.as_view(form_class=EmailValidationOnForgotPassword), name='password_reset'),

Please be aware that this can be used to obtain usernames/e-mails. One way to reduce this issue is to respond with a 429 Too Many Requests as soon an user tries 3 different E-Mails. This can be achived using for example django-ratelimit

score 1 · Answer 3 · answered Jul 20 '22 at 12:08

forms.py

from django.contrib.auth.forms import PasswordResetForm

class EmailValidationOnForgotPassword(PasswordResetForm):
    def clean_email(self):
        email = self.cleaned_data['email']
        if not NewUser.objects.filter(email__iexact=email, is_active=True).exists():
            raise forms.ValidationError("There is no user registered with the specified email address!")
        return email

urls.py

from users.forms import EmailValidationOnForgotPassword
from django.contrib.auth import views as auth_views

urlpatterns = [
    path('admin/', admin.site.urls),
    path('',include('users.urls',namespace='users')),
 
    path('reset_password', auth_views.PasswordResetView.as_view(form_class=EmailValidationOnForgotPassword), name='reset_password'),
    path('reset_password_sent',auth_views.PasswordResetDoneView.as_view(), name='password_reset_done'),
    path('reset/<uidb64>/<token>/', auth_views.PasswordResetConfirmView.as_view(), name='password_reset_confirm'),
    path('reset_password_complete/', auth_views.PasswordResetCompleteView.as_view(), name='password_reset_complete'),
]

password_reset_form.html

 <form method="post">{% csrf_token %}

   {% if form.errors %}
   {% for field in form %}
   {% for error in field.errors %} 
   <div class="alert alert-danger">
      <strong>{{ error|escape }}</strong>
   </div>
   {% endfor %}
   {% endfor %}
   {% endif %} 

   <div class="form-group">
      <label><strong>Email</strong></label>
      {{ form.email|attr:"type:email"|attr:"class:form-control"|attr:"placeholder:Email" }}
   </div>
   <div class="text-center">
      <button type="submit" class="btn btn-primary btn-block">SUBMIT</button>
   </div>
</form>

Inform user that email is invalid using Django's Password Reset

3 Answers3

Linked