[Answered ]-Why does password reset works with unregistered email in django?

2👍

  1. I presume the problem is that your development environment isn’t set up to send emails? In that case, add this in your settings_local(or equivalent):

    EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'
    

    This will cause emails to be displayed in the runserver terminal. You can copy-paste any links from there.

  2. That is deliberate, to not-allow outside users to poke at the registration form and see whether a particular email has been registered or not. A “privacy feature”, I guess we could call it.

  3. POST-ing to the same URL is a standard practice in Django. It is not a requirement, but it just makes sense to do that. It makes sense because that way a single View handles both creating of the Form and receiving the data, see Using a form in a view
    And the redirection happens from the View, deliberately:

    def form_valid(self, request, form):
    
        # blah blah...
    
        return redirect(success_url)
    

    The redirection after a POST is also a standard practice, and not just in Django: http://en.wikipedia.org/wiki/Post/Redirect/Get

👤frnhr

0👍

I doesn’t display “no such registered email address is found”, as it is the best practice approach against phishing attempts. However, you can always write your own code to check if the given email exists in your DB. As for how the user gets redirected to ‘/accounts/password/reset/done/’, I’d have to see the ‘Reset password’ view to know for sure.

👤ryan

Leave a comment