Django登录页面验证异常：用户不存在仍跳转首页问题

问题描述 #

我有一个登录页面，要求用户输入用户名（Username）、邮箱（Email ID）和密码（Password）。在views.py中校验这些输入是否与数据库数据匹配：

• 若三者均正确，说明用户已存在，应跳转至首页；
• 若不匹配，需在当前HTML页面显示错误提示："用户不存在，请注册"。

目前已完成校验逻辑，但点击登录提交按钮时，即便用户不存在，页面仍会跳转至首页。

相关代码 #

Login.html #

<body>
<div class = "tablediv">
    <div><h1>LOGIN FORM</h1></div>
    {% if message != "verification successfull!" %}
        <p class = "error">{{ message }}</p>
        <form action="" method="POST">
    {% else %}
        <form action="{% url 'helloworld' %}" method="POST">
    {% endif %}
        {% csrf_token %}
        <div>
            <label for = "name"><b>Username</b></label><br>
            <input type = "text" id = "name" placeholder = "Enter username here" name = "username" required> 
        </div><br>
        <div>
            <label for = "mail"><b>Email ID</b></label><br>
            <input type = "email" id ="mail" placeholder=" Enter mail id here" name = "email">
        </div>
        <br>
        <div>
            <label for = "pass" maxlength = "10" ><b>Password</b></label><br>
            <input type = "password" id = "pass" name = "password" required>
        </div>
        <br>
        <div>   
            <input type = "checkbox" id = "remember" checked>
            <label for="remember">Remember me</label>
        </div>
        <br>
        <input type = "submit" value = "LOGIN">
    </form>
</div>
<div class="container" >
    <!-- <button type="button" class="cancelbtn">Cancel</button>s -->
    <span class="psw">Forgot <a href="#">password?</a></span>
</div>

Views.py #

def Login(request):
    username = ''
    passwd = ''
    email = ''
    signupform = SignUPform(request.POST)
    print(request.method)
    dbprint = list(SignUPdb.objects.all().values())
    print(dbprint)
    for i in dbprint:
        i.pop('id')
    print(dbprint)
    message = ""
    if request.method == "POST" and signupform.is_valid():
        print("inside POST")
        username = signupform.cleaned_data['username']
        email = signupform.cleaned_data['email']
        passwd = signupform.cleaned_data['password']
        newdict = {
            'username' : username,
            'email' : email,
            'password' : passwd
        }
        print(newdict)
        if newdict in dbprint:
            message = "verification successfull!"
            print(message)
        else:
            message = "user not found. please signup to proceed."
            print(message)
    return render(request, "login.html", {'message' : message })

def Home(request):
    return HttpResponse("Hello World <3 !!")

Urls.py #

urlpatterns = [
    path('addtodb/', FormPage, name = 'addtodb'),
    path('helloworld/', Home, name = 'helloworld'),
]

form.html #

<form action = "/form/" method = "POST">
{% csrf_token %}
<label for="your_name">Your name: </label>
<input id="your_name" type="text" name="name" REQUIRED>
<input type="submit" value= ok ><br>

问题原因及解决方案 #

核心问题 #

1. 视图未处理跳转逻辑：当前Login视图无论验证成功与否，都返回登录页面的渲染结果，没有在验证成功时执行跳转操作。
2. 前端表单Action逻辑错误：通过message动态切换表单action的方式不可靠，初始加载时message为空，表单提交仍指向当前视图；且验证成功后也未触发实际跳转。
3. 缺少登录页面的URL配置：urls.py中未添加登录页面的路由，导致表单提交的目标路径不明确。

修改步骤 #

1. 完善Urls.py，添加登录路由

在urlpatterns中添加Login视图的路径：

from django.urls import path
from . import views  # 确保导入你的视图模块

urlpatterns = [
    path('addtodb/', views.FormPage, name = 'addtodb'),
    path('helloworld/', views.Home, name = 'helloworld'),
    path('login/', views.Login, name='login'),  # 添加登录路由
]

2. 修改Views.py的Login函数，添加跳转逻辑

当验证成功时，使用redirect跳转到首页，失败则渲染登录页面并传递错误信息：

from django.shortcuts import render, redirect  # 导入redirect

def Login(request):
    username = ''
    passwd = ''
    email = ''
    # 仅在POST请求时初始化表单，GET请求时传入空值避免报错
    signupform = SignUPform(request.POST if request.method == "POST" else None)
    message = ""
    if request.method == "POST" and signupform.is_valid():
        username = signupform.cleaned_data['username']
        email = signupform.cleaned_data['email']
        passwd = signupform.cleaned_data['password']
        # 直接查询数据库，替代遍历列表的低效方式
        user_exists = SignUPdb.objects.filter(
            username=username,
            email=email,
            password=passwd
        ).exists()
        if user_exists:
            # 验证成功，跳转至首页
            return redirect('helloworld')
        else:
            message = "用户不存在，请注册"
    # GET请求或验证失败时，渲染登录页面
    return render(request, "login.html", {'message': message})

3. 简化Login.html的表单逻辑

去掉动态切换action的代码，统一表单提交目标为登录路由，并调整错误提示的显示条件：

<body>
<div class = "tablediv">
    <div><h1>LOGIN FORM</h1></div>
    {% if message %}
        <p class = "error">{{ message }}</p>
    {% endif %}
    <form action="{% url 'login' %}" method="POST">
        {% csrf_token %}
        <div>
            <label for = "name"><b>Username</b></label><br>
            <input type = "text" id = "name" placeholder = "Enter username here" name = "username" required> 
        </div><br>
        <div>
            <label for = "mail"><b>Email ID</b></label><br>
            <input type = "email" id ="mail" placeholder=" Enter mail id here" name = "email" required>
        </div>
        <br>
        <div>
            <label for = "pass"><b>Password</b></label><br>
            <input type = "password" id = "pass" name = "password" required>
        </div>
        <br>
        <div>   
            <input type = "checkbox" id = "remember" checked>
            <label for="remember">Remember me</label>
        </div>
        <br>
        <input type = "submit" value = "LOGIN">
    </form>
</div>
<div class="container" >
    <span class="psw">Forgot <a href="#">password?</a></span>
</div>
</body>

额外优化建议 #

• 密码存储安全：当前代码直接存储明文密码，存在严重安全隐患，建议使用Django内置的make_password和check_password函数加密存储并验证密码。
• 表单验证优化：使用Django的表单类处理验证逻辑，避免手动遍历数据库，提升效率和安全性。

内容的提问来源于stack exchange，提问作者Krishna