Django signal user_logged_in is not always fired when login via login endpoint is performed successfully
apragacz opened this issue · 0 comments
Checklist
- I read Contribution Guidelines
- I searched existing issues before opening this one
- This is not a major security issue
- I reproduced the bug with the newest version
Optional checklist
- I attached a PR with a test case reproducing the problem
Describe the bug
This is spin-off from issue #276
For session-based logins, we're using auth.login()
:
which in turn fires user_logged_in
signal:
https://github.com/django/django/blob/5e98959d9242c57a55c65847758781f82d386fa4/django/contrib/auth/__init__.py#L152
which will run connected update_last_login
handler:
https://github.com/django/django/blob/9c19aff7c7561e3a82978a272ecdaad40dda5c00/django/contrib/auth/apps.py#L28
However, for token-based logins, we're not using auth.login()
for obvious reasons. but we neither fire user_logged_in
signal, which should be fired in that case.
The consequence of that is last_login
field is not updated.
Expected behavior
user_logged_in
is being fired exactly once when successful login happens using the LoginView
/ login()
API view.
Actual behavior
user_logged_in
is being fired only when session-based login happens.
Steps to reproduce
Steps to reproduce the behavior:
Provide a token-only login based configuration
Diagnostic info
n/a
Additional context
n/a