apragacz/django-rest-registration

Django signal user_logged_in is not always fired when login via login endpoint is performed successfully

apragacz opened this issue · 0 comments

Checklist

  • I read Contribution Guidelines
  • I searched existing issues before opening this one
  • This is not a major security issue
  • I reproduced the bug with the newest version

Optional checklist

  • I attached a PR with a test case reproducing the problem

Describe the bug

This is spin-off from issue #276

For session-based logins, we're using auth.login():

auth.login(request, user, backend=login_auth_backend)

which in turn fires user_logged_in signal:
https://github.com/django/django/blob/5e98959d9242c57a55c65847758781f82d386fa4/django/contrib/auth/__init__.py#L152

which will run connected update_last_login handler:
https://github.com/django/django/blob/9c19aff7c7561e3a82978a272ecdaad40dda5c00/django/contrib/auth/apps.py#L28

However, for token-based logins, we're not using auth.login() for obvious reasons. but we neither fire user_logged_in signal, which should be fired in that case.

The consequence of that is last_login field is not updated.

Expected behavior

user_logged_in is being fired exactly once when successful login happens using the LoginView / login() API view.

Actual behavior

user_logged_in is being fired only when session-based login happens.

Steps to reproduce

Steps to reproduce the behavior:
Provide a token-only login based configuration

Diagnostic info

n/a

Additional context

n/a