Django账号激活后无法登录问题排查求助

我正在开发一个Django项目，已完成注册、登录、登出及激活视图的开发。注册功能正常，用户注册后会收到邮箱激活链接，但使用该已激活账号登录时，系统提示“无效凭据”，不过管理员账号可正常登录。

注册视图代码 #

def register(request):
    if request.method == 'POST':
        form = RegistrationForm(request.POST)
        if form.is_valid():
            first_name = form.cleaned_data['first_name']
            last_name = form.cleaned_data['last_name']
            phone_number = form.cleaned_data['phone_number']
            email = form.cleaned_data['email']
            password = form.cleaned_data['password']
            username = email.split('@')[0]
            user = Account.objects.create_user(first_name=first_name, last_name=last_name, email=email, username=username, password=password)
            user.phone_number = phone_number
            user.save()
            
             # Create a user profile
            profile = UserProfile()
            profile.user_id = user.id
            profile.profile_picture = 'default/default.png'
            profile.save()
           
            
            #user activation
            current_site = get_current_site(request)
            mail_subject = "WElcome to ECO, Please activate your account"
            message = render_to_string('ecousers/account_verification_email.html', {
                'user': user,
                'domain':current_site,
                'uid': urlsafe_base64_encode(force_bytes(user.pk)),
                'token': default_token_generator.make_token(user),
            })
            to_email = email
            send_email = EmailMessage(mail_subject, message, to=[to_email])
            send_email.send()
            # messages.success(request, "Account created successfully")
            return redirect('/accounts/login/?command=verification&email='+email)
    else:
        
        form = RegistrationForm()
    context = {
        'form': form,
    }
    return render(request, 'ecousers/register.html', context)

登录与激活视图代码 #

def login(request):
    if request.method =="POST":
        email = request.POST['email']
        password = request.POST['password']

        user = auth.authenticate(email=email, password=password)

        if user is not None:
            auth.login(request, user)

            return redirect('/')

        else:
            messages.error(request, "Invalid login credentials")
            return redirect('ecousers:login')
    return render(request, 'ecousers/login.html')

def activate(request, uidb64, token):
    try:
        uid = urlsafe_base64_decode(uidb64).decode()
        user = Account._default_manager.get(pk=uid)
    except(TypeError, ValueError, OverflowError, Account.DoesNotExist):
        user =None
    
    if user is not None and default_token_generator.check_token(user, token):
        user.is_active = True
        user.save()
        messages.success(request, 'Congratulations!! Your account is activated')
        return redirect('ecousers:login')
        
    else:
        messages.error(request, 'Invalid activation link')
        return redirect('ecousers:register')

请问可能是什么问题导致账号激活后无法登录？

可能的排查方向 #

• 认证后端配置缺失：Django默认认证后端仅支持username字段登录，如果你的Account模型以email作为登录标识，需在settings.py中配置支持邮箱登录的认证后端：

  AUTHENTICATION_BACKENDS = [
      'django.contrib.auth.backends.ModelBackend',
      # 或自定义后端类，比如：
      'your_app.backends.EmailAuthenticationBackend',
  ]
  

  未配置的话，auth.authenticate(email=email, password=password)无法正确匹配用户。

• 密码哈希异常：检查Account模型的create_user方法是否正确处理密码哈希。若模型继承自AbstractBaseUser，默认create_user会自动哈希密码；但如果自定义了该方法且未正确调用set_password，会导致密码明文存储，登录时认证失败。可直接查看数据库中password字段是否为哈希格式（如以pbkdf2_sha256$开头）。

• USERNAME_FIELD未设置为邮箱：若Account模型未指定USERNAME_FIELD = 'email'，Django会默认用username作为登录匹配字段，此时auth.authenticate的email参数无法找到对应用户。

• 用户名重复冲突：注册时用email.split('@')[0]生成username，若多个用户邮箱前缀相同，会导致username重复。虽然create_user会抛出异常，但如果未捕获处理，可能出现用户创建异常或后续用户覆盖问题，可检查数据库中用户username的唯一性。

• 激活后用户状态未正确保存：直接查看数据库中该用户的is_active字段是否为True，排除激活逻辑中保存失败的可能。

内容的提问来源于stack exchange，提问作者unuefe ejovwoke