是否可以使用 dj-rest-auth 缩短 email 确认密钥？

Question

I am making a rest api for mobile application. I am using dj-rest-auth package for the overall authentication process. Overall auth functionality works fine but One thing I want to modify is to make the email confirmation key shorter.

User will get email like this.

Please use this key to confirm your email.

MjE:1l7ZhR:f6U2RWlx2kEJY2jXzFuAuKpKclNyc3MpaKmeiEFGp3Y

In my email verify api user need to enter this whole key for verification.

Is there any way to make this key shorter so that it will be good from user perspective(I think)?

I have made my custom adapter here.

class MyAdapter(DefaultAccountAdapter):
    def send_confirmation_mail(self, request, emailconfirmation, signup):
        current_site = get_current_site(request)
        activate_url = self.get_email_confirmation_url(
            request,
            emailconfirmation)
        ctx = {
            "user": emailconfirmation.email_address.user,
            "activate_url": activate_url,
            "current_site": current_site,
            "key": emailconfirmation.key,

        }

Answer 1

Looking at your code I guess you are using django-allauth ( https://github.com/pennersr/django-allauth ).

In this example I assumed that user is authenticated and verifcation code doesn't have to be unique.

If you want to create a shorter key and store it in db you should create custom model where key fits your needs ( 4 digit in this example - I assumed your user put in manually ):

class ActivationKey(models.Model):
    user = models.ForeignKey(User, verbose_name=_("user"), on_delete=models.CASCADE)
    key = models.PositiveSmallIntegerField(_("key"))
    created_at = models.DateTimeField(auto_now_add=True)
    
    @classmethod
    def create(cls, user):
        key = random.randint(1000, 9999)
        return cls._default_manager.create(user=user, key=key)

We can generate key after user creation (override save() or use signal or create before sending email). As you pointed you can override send_confirmation_mail so for simplicity in this example I use it:

class MyAdapter(DefaultAccountAdapter):
    def send_confirmation_mail(self, request, emailconfirmation, signup):
        current_site = get_current_site(request)
        ctx = {
            "user": emailconfirmation.email_address.user,
            "activate_url": reverse("account_confirm_key"),  # depends on you - if you need it at all
            "current_site": current_site,
            "key": ActivationKey.objects.create(user=user) # create key
        }
        if signup:
            email_template = "account/email/email_confirmation_signup"
        else:
            email_template = "account/email/email_confirmation"
        self.send_mail(email_template, emailconfirmation.email_address.email, ctx)

Next you should create custom endpoint for confirm code and activate user:

 class VerifyUserView(APIView):
    permission_classes = [permissions.IsAuthenticated]

    def post(self, request):  # or change to get if more proper to you
        key = request.data.get("key")
        if not key:
            return Response({"error": _("Key is missing")}, status=status.HTTP_400_BAD_REQUEST)
        if not ActivationCode.objects.filter(user=request.user, key=key).exists():
           return Response({"error": _("Wrong activation key")}, status=status.HTTP_400_BAD_REQUEST)

        get_adapter(request).confirm_email(request, user.email)  # confirm method from adapter
        return Response({"status": "ok"})

And remember about settings: ACCOUNT_ADAPTER = MyAdapter

About django-allauth:

Default configuration ( https://dj-rest-auth.readthedocs.io/en/latest/configuration.html ) for email verification is ACCOUNT_EMAIL_CONFIRMATION_HMAC = True which means django would generate HMAC ( https://en.wikipedia.org/wiki/HMAC ) key. If you change option to False key will be generated and stored in EmailConfirmation model: https://github.com/pennersr/django-allauth/blob/da5ccdcf171e32ab1a438add3af38957f5a0659a/allauth/account/models.py#L100 but probably too long for you - 64 chars

Another option is that you create short link (eg bit.ly) for user without changing anything. Or maybe if this is for mobile application you can create deeplink, so after clicking confirmation link (even long) user will be redirect to mobile app and then mobile app send request to backend?