[Django]-Django account_activation_token.check_token always return False in constant_time_compare()

by

8👍

Change this line in :

return six.text_type(user.pk) + six.text_type(timestamp) + six.text_type(user.is_active)

to this line:

return six.text_type(user.pk) + six.text_type(timestamp) + six.text_type(user.username)

And it works. I workaround with this method. But don’t know the cause.

👤Nick Wong

0👍

The problem is when you verify if form is valid and set the value of user.is_active, you have to set it to 0 and not to False, because when you call activate function, it passes the value of user.is_active from db and it’s 0 or 1 (not True or False).

👤Filippo Cicognani

0👍

The is_active (0 and False being different) problem has already been covered and answered. Another problem is within

url(r'activate/(?P<uidb64>[0-9A-Za-z_\-]+)/(?P<token>[0-9A-Za-z]{1,13}-[0-9A-Za-z]{1,20})/$',
        activate, name='activate'),

When you click on email activation link, if a parameter is longer than permitted size, that parameter will be truncated. In my case, the token was too long and therefore, I increased it from {1,20} to {1,40}. After a lot of frustration, this turned out to the issue.

👤Richard

Leave a comment