Django rest framework user registration?

Question

I am following this tutorial but facing these problems I can't fix:

Upon registering user, I can not log in with that user to the api because the password is not hashed "Invalid password format or unknown hashing algorithm." in admin
I cannot post to 'api/accounts' or see the form in the browseable api when I am not logged in to the api

My code:

from django.contrib.auth.models import User
from rest_framework import serializers

class UserSerializer(serializers.ModelSerializer):
    class Meta:
        model = User
        fields = ('password', 'first_name', 'last_name', 'email')
        write_only_fields = ('password',)

    def restore_object(self, attrs, instance=None):
        # call set_password on user object. Without this
        # the password will be stored in plain text.
        user = super(UserSerializer, self).restore_object(attrs, instance)
        user.set_password(attrs['password'])  #somehow not hashing
        return user

In DRF 3.0, `write_only_fields = ('password',)` is changed to `extra_kwargs = {'password': {'write_only': True}, }` — Chemical Programmer, Dec 09 '15 at 13:00
Another good solution : http://stackoverflow.com/questions/27468552/changing-serializer-fields-on-the-fly/#answer-27471503 — Chemical Programmer, Dec 09 '15 at 13:03

score 13 · Answer 1 · answered Jan 11 '15 at 10:25

13

I tried the accepted answer in DRF 3.0.2 and it didn't work. The password was not being hashed.

Instead, override the create method in your model serializer

    def create(self, validated_data):
        user = User(email=validated_data['email'], username=validated_data['username'])
        user.set_password(validated_data['password'])
        user.save()
        return user

This hashes the password when you create a user using the rest framework, not post_save

answered Jan 11 '15 at 10:25

wsgeorge

1,928
17
20

4

It might be easier to user `User.objects.create_user(**validated_data)` to create the user (with hashed password) rather than doing it in two lines – aensm Nov 18 '15 at 22:27

score 6 · Answer 2 · answered Mar 08 '16 at 16:43

6

Another approach for DRF 3.X:

from django.contrib.auth import get_user_model
from django.contrib.auth.hashers import make_password

    def create(self, validated_data):    
        if validated_data.get('password'):
            validated_data['password'] = make_password(
                validated_data['password']
            )

        user = get_user_model().objects.create(**validated_data)

        return user

answered Mar 08 '16 at 16:43

psychok7

5,373
9
63
101

1

you are perfect – Tolgahan ÜZÜN Oct 24 '17 at 20:43

score 3 · Answer 3 · edited May 23 '17 at 10:30

I've used wsgeorge's solution to build my own. A blank User object is created just so I can use .set_password():

def create(self, validated_data):
    user = User()
    user.set_password(validated_data['password'])
    validated_data['password'] = user.password
    return super(UserSerializer, self).create(validated_data)

Different from his answer, I do not save the user myself. I leave that to the parent class calling super.

user3149525 · Accepted Answer · 2014-04-18T17:34:05.477

1

Please note that set_password() does NOT save the object and since you have called the super first, your object is already saved with raw password.

Just simply use post_save() to save the password.

def post_save(self, obj, created=False):
    """
    On creation, replace the raw password with a hashed version.
    """
    if created:
        obj.set_password(obj.password)
        obj.save()

edited Apr 18 '14 at 17:34

answered Apr 13 '14 at 07:57

user3149525

293
2
4
10

score 0 · Answer 5 · answered Aug 05 '18 at 21:48

Override create of model serialzier

def create(self, validated_data):
        if validated_data.get('password'):
            validated_data['password'] = make_password(validated_data['password'])
        return super(UserSerializer, self).create(validated_data)

Be sure to import

from django.contrib.auth.hashers import make_password

score -1 · Answer 6 · answered Jul 06 '15 at 11:56

-1

We can write a signal in User to solve this.

def create_hash(sender, instance=None, *args, **kwargs):
passwd = instance.password
instance.set_password(passwd)


pre_save.connect(create_hash, sender=User)

answered Jul 06 '15 at 11:56

asitm9

853
4
12
21

Django rest framework user registration?

6 Answers6

Linked