Question

I am trying to create an application in which users are locked out from logging in due to too many failed login attempts.

To this end, if there are 5 failed logins within 5 minutes, a Lockout object is created, and the user is deactivated (is_active=False).

However, when this Lockout object is deleted, the user should be immediately made active again (is_active=True).

To do this, I must override the delete() function for the Lockout model so as to activate the user upon deletion. This code, which I think follows documentation, isn’t working:

def delete(self):
        self.user.is_active = True
        self.user.save()
        super(Lockout, self).delete()

I was wondering if this was the proper way to do this?

Thanks a lot.

Answer 1

That’s the correct way to do it. The problem you’re having is that you’re trying to delete via a QuerySet, which does not invoke the model methods. You will need to .filter(), then iterate through it calling .delete() on each model.

But it would probably be easier to create a new auth backend that checked for a lockout instead of going through these acrobatics.