Django中登录失败≤3次时隐藏reCAPTCHA错误提示问题咨询

问题根源 #

你当前的reCAPTCHA装饰器会对所有登录POST请求执行验证码校验，校验失败就直接抛出错误，完全没有关联登录失败次数的判断逻辑，因此无论是否需要展示验证码，只要提交的请求中没有有效验证码就会弹出错误提示。

修复方案 #

1. 修改reCAPTCHA装饰器

移除装饰器中直接添加错误消息的逻辑，仅保留验证码校验结果的标记功能：

from functools import wraps
from django.conf import settings
import requests

def check_recaptcha(view_func):
    @wraps(view_func)
    def _wrapped_view(request, *args, **kwargs):
        request.recaptcha_is_valid = None
        if request.method == 'POST':
            recaptcha_response = request.POST.get('g-recaptcha-response')
            data = {
                'secret': settings.RECAPTCHA_PRIVATE_KEY,
                'response': recaptcha_response
            }
            r = requests.post('https://www.google.com/recaptcha/api/siteverify', data=data)
            result = r.json()
            request.recaptcha_is_valid = result['success']
        return view_func(request, *args, **kwargs)
    return _wrapped_view

2. 修改登录视图逻辑

在计算完登录失败次数后，仅当失败次数超过3次时，才判断验证码有效性并对应抛出错误：

@axes_dispatch
@check_recaptcha
def loginpage(request, credentials: dict = None):
    attempts_list = get_user_attempts(request, credentials)
    attempt_count = max(
        (
                attempts.aggregate(Sum("failures_since_start"))[
                    "failures_since_start__sum"
                ]
                or 0
        )
        for attempts in attempts_list
    )
    attempt_count = attempt_count +1
    context = {'attempt_count': attempt_count}

    if request.method == 'POST':
        # 仅当失败次数超过3次时，才校验验证码并抛出错误
        if attempt_count > 3 and not request.recaptcha_is_valid:
            messages.error(request, 'Invalid reCAPTCHA. Please try again.')
            
        username = request.POST.get('username')
        password = request.POST.get('password')
        user = authenticate(request, username=username, password=password)

        if user is not None:
            if user.is_active and attempt_count <= 3:
                login(request, user)
                return redirect('home')
            if user.is_active and attempt_count > 3 and request.recaptcha_is_valid:
                login(request, user)
                return redirect('home')
            if not user.is_active:
                messages.error(request, 'Account for this User has not been Activated.')
        else:
            messages.error(request, 'Username or Password is Incorrect.')

    return render(request, 'login.html', context)

逻辑验证 #

修改完成后：

• 登录失败次数≤3次时，完全忽略验证码校验结果，不会出现任何验证码相关提示
• 登录失败次数>3次时，才会校验验证码有效性，校验失败才展示对应错误提示，和验证码展示逻辑完全对齐

内容的提问来源于stack exchange，提问作者rob