Question

I am having trouble figuring out how to control field validation for ModelForms.

Here is my Model Form:

class UserForm(ModelForm):
    class Meta:
        model = User
        fields = ('email', 'password')

Here is how I am rendering my form in the template:

<form method="post" action="">
    {% csrf_token %}
    {{ userform.as_p }}
    <input type="submit" value="Submit" />
</form>

Here is my view:

def login_page(request):
    if request.method == 'POST':
        userform = UserForm(request.POST)
        if userform.is_valid():
            email = request.POST['email']
            password = request.POST['password']
            user = authenticate(username=email, password=password)
            if user is not None:
                login(request, user)
                return redirect('/dashboard/')
            else:
                # How can I give the user feedback about authentication failute here. Right now it just reloads the form without any messages.
                return render(request, "login.html", {"userform": userform}) 
        else:
            # Because .is_valid() is called, The userform will validate for email addresses and that a password input is present here.
            return render(request, "login.html", {"userform": userform}) 
    else:
        userform = UserForm()
        return render(request, "login.html", {"userform": userform})

From reading the docs, this seems like it should be as simple as passing my form some custom attribute; but since I am working with a ModelForm, I am unsure whether this is achieved in the same way.

Could anyone provide an example or tips on how best to control ModelForm field errors?

Thanks!

Answer 1

The Django authentication app has a built in AuthenticationForm that you use. If you look at the source code, you can see their approach is to check the username and password inside the clean method. That way, a validation error can be raised if the username and password combination is invalid, and the form will display the error.

You can import the AuthenticationForm and use it in your login view with the following import:

from django.contrib.auth.forms import Authentication

You may also be able to use the built in login view as well. This means you can take advantage of the added functionality, such as displaying a message if the user does not have cookies enabled. It also decreases the chance of you creating a security vulnerability.