继承Django AuthenticationForm时is_valid()验证异常问题求助

问题描述 #

继承Django内置AuthenticationForm实现Bootstrap样式的LoginForm后，当用户输入错误凭证（如用户名正确但密码错误）时，is_valid()无法触发失败逻辑，无法展示错误提示；但继承forms.Form的同功能表单却能正常工作。

相关代码 #

问题表单代码 #

class LoginForm(AuthenticationForm):
    username = UsernameField(
        widget = forms.TextInput(attrs={'autocomplete':'off','class':'form-control','placeholder':'Enter your email'})
        )
    password = forms.CharField(
        label=_('Password'),
        strip=False,
        widget=forms.PasswordInput(attrs={'autocomplete':'off','class':'form-control','placeholder':'Enter your password'})
        )

视图代码 #

def signin(request):
    if request.method == 'POST':
        form = LoginForm(data=request.POST)
        if form.is_valid():
            print('1')
            username = form.cleaned_data['username']
            password = form.cleaned_data['password']
            user = authenticate(request,username=username,password=password)
            print('2')
            if user is not None:
                login(request,user)
                print('3')

                return redirect('registration')
            else:
                print('4')
                messages.warning(request,'Wrong Credentials!')
        else:  # Use form.errors for displaying errors
            print(form.errors)
    else:
        print('get')
        form = LoginForm()
    return render(request,'account/login.html',{'form':form})

正常工作的测试表单代码 #

class LoginForm(forms.Form):
    def __init__(self,*args,**kwargs):
        super().__init__(*args,**kwargs)

    username = forms.CharField(max_length=150,widget=forms.TextInput(attrs={"autofocus": True,'class':'form-control','placeholder':'Enter your Email',}))

    password = forms.CharField(max_length=150, widget=forms.PasswordInput(attrs={"autocomplete": "current-password",'class':'form-control','placeholder':'Enter your password',}))

Admin配置代码 #

from django.contrib import admin
from django.contrib.auth.models import Group
from django.contrib.auth.admin import UserAdmin as BaseUserAdmin

from .models import CustomUser

# Register your models here.
class UserAdmin(BaseUserAdmin):
    list_display = ["email", "username", "is_staff"]
    list_filter = ["is_superuser"]
    fieldsets = [
        (None, {"fields": ["email", "password"]}),
        ("Personal info", {"fields": ["first_name","last_name"]}),
        ("Permissions", {"fields": ["is_superuser"]}),
    ]
    add_fieldsets = [
        (
            None,
            {
                "classes": ["wide"],
                "fields": ["email", "username", "password1", "password2"],
            },
        ),
    ]
    search_fields = ["email"]
    ordering = ["email"]
    filter_horizontal = []
admin.site.register(CustomUser, UserAdmin)
admin.site.unregister(Group)

核心问题 #

1. AuthenticationForm初始化缺少request参数：该表单的构造必须传入request作为第一个参数，你之前只传了data=request.POST，导致内置验证逻辑无法正常执行。
2. 重复验证逻辑冲突：AuthenticationForm的clean()方法已经内置了凭证验证（自动调用authenticate），验证失败时会直接抛出ValidationError，让is_valid()返回False并将错误信息存入form.errors。但你的视图在is_valid()通过后又手动调用authenticate，完全违背了该表单的设计逻辑。

修复方案 #

1. 修正LoginForm（可选，保留字段自定义） #

重写字段时不破坏原有验证逻辑，仅修改Widget属性：

from django.contrib.auth.forms import AuthenticationForm, UsernameField
from django import forms
from django.utils.translation import gettext_lazy as _

class LoginForm(AuthenticationForm):
    username = UsernameField(
        widget=forms.TextInput(attrs={
            'autocomplete': 'off',
            'class': 'form-control',
            'placeholder': 'Enter your email'
        })
    )
    password = forms.CharField(
        label=_('Password'),
        strip=False,
        widget=forms.PasswordInput(attrs={
            'autocomplete': 'off',
            'class': 'form-control',
            'placeholder': 'Enter your password'
        })
    )

2. 修正视图逻辑 #

遵循AuthenticationForm的设计，移除手动验证，利用表单内置逻辑：

from django.contrib.auth import login
from django.shortcuts import redirect, render
from django.contrib import messages
from .forms import LoginForm

def signin(request):
    if request.method == 'POST':
        # 必须传入request作为第一个参数
        form = LoginForm(request, data=request.POST)
        if form.is_valid():
            # 直接通过form.get_user()获取验证后的用户
            user = form.get_user()
            login(request, user)
            return redirect('registration')
        # 将表单内置的错误信息转为messages（可选，也可直接在模板渲染form.errors）
        for error in form.non_field_errors():
            messages.warning(request, error)
    else:
        form = LoginForm(request)
    return render(request, 'account/login.html', {'form': form})

3. 模板中渲染错误信息 #

在登录模板account/login.html中添加错误展示：

<!-- 展示非字段错误（如凭证错误） -->
{% if form.non_field_errors %}
    <div class="alert alert-danger">
        {{ form.non_field_errors }}
    </div>
{% endif %}

<!-- 或展示messages -->
{% if messages %}
    {% for message in messages %}
        <div class="alert alert-{{ message.tags }}">
            {{ message }}
        </div>
    {% endfor %}
{% endif %}

<!-- 表单字段渲染 -->
<form method="post">
    {% csrf_token %}
    <div class="mb-3">
        {{ form.username.label_tag }}
        {{ form.username }}
        {% if form.username.errors %}
            <div class="text-danger">{{ form.username.errors }}</div>
        {% endif %}
    </div>
    <div class="mb-3">
        {{ form.password.label_tag }}
        {{ form.password }}
        {% if form.password.errors %}
            <div class="text-danger">{{ form.password.errors }}</div>
        {% endif %}
    </div>
    <button type="submit" class="btn btn-primary">Login</button>
</form>

为什么继承forms.Form的版本能工作？ #

因为forms.Form没有内置凭证验证逻辑，is_valid()仅验证字段格式（如是否为空、长度是否合规），所以即使密码错误，字段验证通过后is_valid()返回True，你的手动authenticate才能触发错误提示。但这是冗余写法，AuthenticationForm已经封装了完整的登录验证逻辑，正确使用即可避免重复代码。

内容的提问来源于stack exchange，提问作者Nazmul Haque