无法通过使用带有用户名和密码的过滤器来获取用户

Question

I am using the following code

email = validated_data["login"]
password = validated_data["password"]
user_obj = User.objects.filter(Q(email__exact=email) & Q(password__exact=password))

I changed the password from admin however no user is returned. However if I remove the password check then I get a user object back.The object that I get back if I remove the Q(password__exact=password) condition has _password field as None. This code has been working fine for a while but today it is not returning back the object. Am I missing something here ? I verified that I am receiving the correct username and password from the client.I also tried accessing the admin with that username and password (The account has staff status) and I was able to log in. So the password is correct but for some reason I cant obtain that user by filtering. ? What might I be doing wrong ?

Answer 1

password isn't stored in plain text, but as a hash (and a little more). Get the user by username and check the password:

# assumes there can be only one
user = User.objects.get(email=email) 
# this checks the plaintext password against the stored hash 
correct = user.check_password(password)  

BTW, you don't need Q objects for logical AND . filter(email__exact=email, password__exact=password) would suffice, even though it doesn't make much sense, in this case.

Answer 2

这是因为Django不会将密码存储为经过哈希处理的简单文本，因此您无法执行password__exact，因为每次您返回相同的哈希password = validated_data["password"]每次都不返回