Django邮箱验证实现求助：现有代码失效，求可行替代方案

先排查你现有代码的核心问题（导致无法运行的关键原因） #

• 创建未激活用户后直接调用login(request, user)，但Django默认认证后端会拒绝登录**未激活（is_active=False）**的用户，会直接抛出认证错误。
• send_mail(subject,message,from_email,[to_email]).save()完全错误：send_mail返回的是成功发送的邮件数量（整数），根本没有save()方法，这行代码会直接触发异常。
• 若UserProfile模型未通过post_save信号自动关联新创建的User，user.profile.code = code会触发RelatedObjectDoesNotExist异常——新用户还没有对应的Profile实例。
• 验证视图verifycode依赖request.user，但未激活用户无法登录，此时request.user是匿名用户，访问request.user.profile会直接报错。

修复现有思路的可行代码 #

第一步：确保Profile模型自动关联User #

先在models.py中添加信号，确保创建User时自动生成对应Profile：

from django.db.models.signals import post_save
from django.contrib.auth.models import User
from django.dispatch import receiver
from .models import UserProfile

@receiver(post_save, sender=User)
def create_user_profile(sender, instance, created, **kwargs):
    if created:
        UserProfile.objects.create(user=instance)

@receiver(post_save, sender=User)
def save_user_profile(sender, instance, **kwargs):
    instance.profile.save()

第二步：修复createuser视图 #

from django.contrib.auth import login
from django.core.mail import send_mail
from django.shortcuts import render, redirect
from .forms import MyUserCreationForm
from django.contrib import messages

def createuser(request):
    form = MyUserCreationForm()
    if request.method == 'POST':
        form = MyUserCreationForm(request.POST)
        if form.is_valid():
            # 生成6位数字验证码
            code = User.objects.make_random_password(length=6, allowed_chars='1234567890')
            
            user = form.save(commit=False)
            user.username = user.username.lower()
            user.email = user.email.lower()
            user.is_active = False  # 先标记为未激活
            user.save()
            
            # 关联验证码到profile（信号已确保profile存在）
            user.profile.code = code
            user.profile.save()
            
            # 发送验证邮件（移除错误的.save()）
            subject = '确认你的邮箱'
            message = f'请使用以下验证码激活你的账号：{code}'
            from_email = 'your-email@gmail.com'
            to_email = user.email  # 直接用保存后的user.email，避免POST数据出错
            send_mail(subject, message, from_email, [to_email])
            
            # 不能登录未激活用户，将用户ID存入session用于后续验证
            request.session['verification_user_id'] = user.id
            return redirect('verification')
        else:
            messages.error(request, '注册过程中出现错误，请检查输入')
    context = {'form': form}
    return render(request, 'signup.html', context)

第三步：修复verifycode视图 #

from django.contrib.auth import login
from django.shortcuts import render, redirect
from django.contrib.auth.models import User

def verifycode(request):
    # 从session获取待验证的用户ID
    user_id = request.session.get('verification_user_id')
    if not user_id:
        # 无验证标记则跳转到注册页
        return redirect('signup')
    
    user = User.objects.get(id=user_id)
    if request.method == 'POST':
        code = request.POST.get('code', '').strip()
        if user.profile.code == code:
            # 激活用户
            user.is_active = True
            user.save()
            # 激活后登录用户
            login(request, user)
            # 清除session验证标记
            del request.session['verification_user_id']
            return redirect('home')
        else:
            return render(request, 'verify.html', {'error': '验证码错误，请重新输入'})
    else:
        return render(request, 'verify.html')

更稳健的替代实现方案（加密Token替代明文验证码） #

明文验证码存数据库有安全风险，可使用Django自带的PasswordResetTokenGenerator生成加密验证Token，通过邮件链接让用户一键激活，无需手动输入验证码：

1. 自定义Token生成器（新建utils.py） #

from django.contrib.auth.tokens import PasswordResetTokenGenerator
from django.utils import six

class AccountActivationTokenGenerator(PasswordResetTokenGenerator):
    def _make_hash_value(self, user, timestamp):
        return (
            six.text_type(user.pk) + six.text_type(timestamp) +
            six.text_type(user.is_active)
        )

account_activation_token = AccountActivationTokenGenerator()

2. 注册视图（发送带Token的激活链接） #

from django.core.mail import send_mail
from django.shortcuts import render, redirect
from django.contrib import messages
from django.template.loader import render_to_string
from django.utils.http import urlsafe_base64_encode
from django.utils.encoding import force_bytes
from .forms import MyUserCreationForm
from .utils import account_activation_token

def createuser(request):
    form = MyUserCreationForm()
    if request.method == 'POST':
        form = MyUserCreationForm(request.POST)
        if form.is_valid():
            user = form.save(commit=False)
            user.username = user.username.lower()
            user.email = user.email.lower()
            user.is_active = False
            user.save()
            
            # 生成加密验证链接
            uid = urlsafe_base64_encode(force_bytes(user.pk))
            token = account_activation_token.make_token(user)
            
            # 用模板渲染邮件内容
            mail_subject = '激活你的账号'
            message = render_to_string('acc_active_email.html', {
                'user': user,
                'uid': uid,
                'token': token,
                'domain': request.get_host()  # 获取当前域名
            })
            send_mail(mail_subject, message, 'your-email@gmail.com', [user.email])
            
            messages.success(request, '请查收邮箱，点击链接激活你的账号')
            return redirect('login')
        else:
            messages.error(request, '注册过程中出现错误，请检查输入')
    context = {'form': form}
    return render(request, 'signup.html', context)

3. 激活视图 #

from django.contrib.auth import login
from django.shortcuts import render, redirect
from django.contrib.auth.models import User
from django.utils.http import urlsafe_base64_decode
from django.utils.encoding import force_str
from .utils import account_activation_token
from django.contrib import messages

def activate(request, uidb64, token):
    try:
        uid = force_str(urlsafe_base64_decode(uidb64))
        user = User.objects.get(pk=uid)
    except(TypeError, ValueError, OverflowError, User.DoesNotExist):
        user = None
    if user is not None and account_activation_token.check_token(user, token):
        user.is_active = True
        user.save()
        login(request, user)
        messages.success(request, '账号激活成功！')
        return redirect('home')
    else:
        messages.error(request, '激活链接无效或已过期')
        return redirect('signup')

4. 添加URL路由 #

path('activate/<uidb64>/<token>/', views.activate, name='activate'),

内容的提问来源于stack exchange，提问作者Adryan Taborda