CODEWITHSUNDEEP
pythonhtmldjango
Sahand
Sahand

Reputation: 8370

Django puts my password in browser url field

I have the following view class:

class LoginView(View):

    form_class = LoginForm
    template_name = 'workoutcal/login.html'

    def post(self, request):

        form = self.form_class(request.POST)

        if form.is_valid():

            email = form.cleaned_data['email']
            password = form.cleaned_data['password']

            user = authenticate(email = email, password = password)

            if user is not None:

                if user.is_active:
                    login(request, user)
                    return calendar(request)
            else:
                return render(request, self.template_name, {'form':form})
        else:
            form['custom_error_message'] = 'Invalid user'
            return render(request, self.template_name, {'form':form})

    def get(self, request):

        form = self.form_class(None)

        return render(request, self.template_name, {'form':form})

And this template:

login.html

{% extends "workout/base.html" %}

{% block logoutwidget %}{% endblock %}

{% block content %}
    <form action="/workoutcal/login/">
        {% include "workoutcal/form_disp_errors.html" %}
        <input type="submit" value="Log in">
    </form>
{% endblock %}

form_disp_errors.html

{% csrf_token %}
{{ form.custom_error_message }}
{{ form.non_field_errors }}
{% for field in form.visible_fields %}
    <div class="row">
        <div class="col-xs-2">
            {{ field.label_tag }}
        </div>
        <div class="col-xs-2">
            {{ field }}
        </div>
        <div class="col-xs-3">
            {{ field.errors }}
        </div>
    </div>

{% endfor %}

When I go to workoutcal/login, type in an incorrect username and password (user doesn't exist), the page goes to workoutcal/login again, but with this url: 

http://localhost:8000/workoutcal/login/?csrfmiddlewaretoken=ZywQUh7gnNfaHi8FcA3be4ynLB7SpGgwdJ0UxGzUuRYp0G0Y9LQ9e24Jx8Q1OD3Y&email=myemail%40hotmail.com&password=MYPASSWORD

As you can see in the end of the link, the password is displayed. This is obviously not good. However, I can't understand why it happens. Any ideas?

Upvotes: 0

Views: 192

Answers (1)

Mark Mishyn
Mark Mishyn

Reputation: 4151

You have to use HTTP method POST, for that you must set attribute method="post" to your form tag. Like that:

 <form method="post" action="/workoutcal/login/" >

With method POST request will send query string (key/value pairs) in HTTP message body instead of URL.

Note: consider using PUT/PATCH to update objects and DELETE to remove for RESTful APIs (by default Django will use method POST for all these cases).

Upvotes: 3

Related Questions