自定义 Django 密码重置 - 链接不会失效答案

【问题标题】：Custom Django Password Reset - Link does not get invalidated自定义 Django 密码重置 - 链接不会失效
【发布时间】：2020-08-16 06:05:48
【问题描述】：

我知道密码重置的一次性链接应按照此处enter link description here 给出的电子邮件密码更改程序失效。然而，在我下面的实现中，虽然链接每次都可以重置密码，但它并没有失效。该链接每次都有效。这可能是什么原因？

（我还看到我要更改密码的特定用户在管理页面中也更新了最后登录时间戳）

(forms.py)

from django.contrib.auth.forms import UserCreationForm, SetPasswordForm 
from django.contrib.auth import get_user_model

class ResetPasswordForm(SetPasswordForm):
    class Meta:
        model = get_user_model()
        fields = ('password1', 'password2')

(tokens.py)

from django.contrib.auth.tokens import PasswordResetTokenGenerator import six

class AccountActivationTokenGenerator(PasswordResetTokenGenerator):
    def _make_hash_value(self, user, timestamp):
        return (
            six.text_type(user.pk) + six.text_type(timestamp) +
            six.text_type(user.email_confirmed)
        )

        account_activation_token = AccountActivationTokenGenerator()

(views.py)

def activate_forgot_password(request, uidb64, token):
    try:
        uid = force_text(urlsafe_base64_decode(uidb64))
        User = get_user_model()
        user = User.objects.get(pk=uid)
    except (TypeError, ValueError, OverflowError, User.DoesNotExist):
        user = None

    if user is not None and account_activation_token.check_token(user, token):
        if request.method == 'POST':
            form = ResetPasswordForm(user, request.POST)
            if form.is_valid():
                user = form.save(commit=False)
                print(user.password)
                user.save()
                login(request, user, backend='mysite.signup.views.EmailBackend')
                return redirect('home')
        else:
            form = ResetPasswordForm(user)
            return render(request, 
                          'change_password.html', 
                          {'form': form, 
                            'uidb64': uidb64, 
                            'token': token})

    return render(request, 'account_forgot_password_token_invalid.html')

(模板.html)

<form id="ResetPasswordForm" method="post" action="{% url 'activate_forgot_password' uidb64=uidb64 token=token %}" validate>
    {% csrf_token %}  
    .
    .
    .
    <div class="form-group">
        <button type="submit" id="btn-signup" class="btn btn-block btn-primary btn-lg">Change Password</button>
    </div>
</form>

【问题讨论】：

标签： django django-rest-framework django-forms django-views django-authentication

【解决方案1】：

_make_hash_value 方法中的字段从未更新，链接仍然有效，直到分配的字段之一更新或令牌超时，您可以添加更多字段以确保触发更改，如 user.last_login 甚至 user.password

【讨论】：