Skip to main content

An extension of django rest framework, providing a configurable password reset strategy

Project description

# Django Rest Password Reset

[![PyPI version](](
[![Build Status](](
[![Known Vulnerabilities](](

This python package provides a simple password reset strategy for django rest framework, where users can request password
reset tokens via their registered e-mail address.

The main idea behind this package is to not make any assumptions about how the token is delivered to the end-user (e-mail, text-message, etc...).
Instead, this package provides a signal that can be reacted on (e.g., by sending an e-mail or a text message).

This package basically provides two REST endpoints:

* Request a token
* Verify (confirm) a token (and change the password)

## Quickstart

1. Install the package from pypi using pip:
pip install django-rest-passwordreset

2. Add ``django_rest_passwordreset`` to your ``INSTALLED_APPS`` (after ``rest_framework``) within your Django settings file:

3. This package provides two endpoints, which can be included by including ``django_rest_passwordreset.urls`` in your ```` as follows:
from django.conf.urls import url, include

urlpatterns = [
url(r'^api/password_reset/', include('django_rest_passwordreset.urls', namespace='password_reset')),
**Note**: You can adapt the url to your needs.

### Endpoints

The following endpoints are provided:

* `POST ${API_URL}/reset_password/` - request a reset password token by using the ``email`` parameter
* `POST ${API_URL}/reset_password/confirm/` - using a valid ``token``, the users password is set to the provided ``password``

where `${API_URL}/` is the url specified in your ** (e.g., `api/password_reset/`)

### Configuration / Settings

The following settings can be set in Djangos ```` file:

* `DJANGO_REST_MULTITOKENAUTH_RESET_TOKEN_EXPIRY_TIME` - time in hours about how long the token is active (Default: 24)

**Please note**: expired tokens are automatically cleared based on this setting in every call of ````.

### Signals

* ``reset_password_token_created(reset_password_token)`` Fired when a reset password token is generated
* ``pre_password_reset(user)`` - fired just before a password is being reset
* ``post_password_reset(user)`` - fired after a password has been reset

### Example for sending an e-mail

1. Create two new django templates: `email/user_reset_password.html` and `email/user_reset_password.txt`. Those templates will contain the e-mail message sent to the user, aswell as the password reset link (or token).
Within the templates, you can access the following context variables: `current_user`, `username`, `email`, `reset_password_url`. Feel free to adapt this to your needs.

2. Add the following code, which contains a Django Signal, to your application (see [this part of the django documentation]( for more information on where to put signals).
from django.dispatch import receiver
from django_rest_passwordreset.signals import reset_password_token_created
from django.urls import reverse

def password_reset_token_created(sender, reset_password_token, *args, **kwargs):
Handles password reset tokens
When a token is created, an e-mail needs to be sent to the user
:param sender:
:param reset_password_token:
:param args:
:param kwargs:
# send an e-mail to the user
context = {
'current_user': reset_password_token.user,
'username': reset_password_token.user.username,
'reset_password_url': "{}?token={}".format(reverse('password_reset:reset-password-request'), reset_password_token.key)

# render email text
email_html_message = render_to_string('email/user_reset_password.html', context)
email_plaintext_message = render_to_string('email/user_reset_password.txt', context)

msg = EmailMultiAlternatives(
# title:
_("Password Reset for {title}".format(title="Some website title")),
# message:
# from:
# to:
msg.attach_alternative(email_html_message, "text/html")


3. You should now be able to use the endpoints to request a password reset token via your e-mail address.
If you want to test this locally, I recommend using some kind of fake mailserver (such as maildump).

## Custom Token Generator

By default, a random string token of length 10 to 50 is generated using the ``RandomStringTokenGenerator`` class.
This library offers a possibility to configure the params of ``RandomStringTokenGenerator`` as well as switch to
another token generator, e.g. ``RandomNumberTokenGenerator``. You can also generate your own token generator class.

You can change that by adding
"CLASS": ...,
"OPTIONS": {...}
into Django file.

### RandomStringTokenGenerator
This is the default configuration.
"CLASS": "django_rest_passwordreset.tokens.RandomStringTokenGenerator"

You can configure the length as follows:
"CLASS": "django_rest_passwordreset.tokens.RandomStringTokenGenerator",
"min_length": 20,
"max_lenght": 30

### RandomNumberTokenGenerator
"CLASS": "django_rest_passwordreset.tokens.RandomNumberTokenGenerator"

You can configure the minimum and maximum number as follows:
"CLASS": "django_rest_passwordreset.tokens.RandomNumberTokenGenerator",
"min_number": 1500,
"max_number": 9999

### Write your own Token Generator

Please see [token_configuration/django_rest_passwordreset/](token_configuration/django_rest_passwordreset/ for example implementation of number and string token generator.

The basic idea is to create a new class that inherits from BaseTokenGenerator, takes arbitrary arguments (`args` and `kwargs`)
in the ``__init__`` function as well as implementing a `generate_token` function.

from django_rest_passwordreset.tokens import BaseTokenGenerator

class RandomStringTokenGenerator(BaseTokenGenerator):
Generates a random string with min and max length using os.urandom and binascii.hexlify

def __init__(self, min_length=10, max_length=50, *args, **kwargs):
self.min_length = min_length
self.max_length = max_length

def generate_token(self, *args, **kwargs):
""" generates a pseudo random code using os.urandom and binascii.hexlify """
# determine the length based on min_length and max_length
length = random.randint(self.min_length, self.max_length)

# generate the token using os.urandom and hexlify
return binascii.hexlify(

## Compatibility Matrix

This library should be compatible with the latest Django and Django Rest Framework Versions. For reference, here is
a matrix showing the guaranteed and tested compatibility.

django-rest-passwordreset Version | Django Versions | Django Rest Framework Versions
--------------------------------- | ----------------| ------------------------------
0.9.7 | 1.8, 1.11, 2.0, 2.1 | 3.6 - 3.9
1.0 (WIP) | 1.11, 2.0, 2.2 | 3.6 - 3.9

## Documentation / Browsable API

This package supports the [DRF auto-generated documentation]( (via `coreapi`) as well as the [DRF browsable API](

![drf_browsable_email_validation](docs/browsable_api_email_validation.png "Browsable API E-Mail Validation")

![drf_browsable_password_validation](docs/browsable_api_password_validation.png "Browsable API E-Mail Validation")

![coreapi_docs](docs/coreapi_docs.png "Core API Docs")

## Known Issues

### Django 2.1 Migrations - Multiple Primary keys for table ...
Django 2.1 introduced a breaking change for migrations (see [Django Issue #29790]( We therefore had to rewrite the migration [](django_rest_passwordreset/migrations/ such that it covers Django versions before (`<`) 2.1 and later (`>=`) 2.1.

Some information is written down in Issue #8.

## Contributions

This library tries to follow the unix philosophy of "do one thing and do it well" (which is providing a basic password reset endpoint for Django Rest Framework). Contributions are welcome in the form of pull requests and issues! If you create a pull request, please make sure that you are not introducing breaking changes.

## Tests

See folder [tests/](tests/). Basically, all endpoints are covered with multiple
unit tests.

Use this code snippet to run tests:
pip install -r requirements_test.txt
python install
cd tests
python test

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for django-rest-passwordreset, version 1.0.0a2
Filename, size File type Python version Upload date Hashes
Filename, size django-rest-passwordreset-1.0.0a2.tar.gz (200.2 kB) File type Source Python version None Upload date Hashes View

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring DigiCert DigiCert EV certificate Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page