Please add a login method to the test Client that doesn't depend on passwords

[James Westby <jw+debian@…>]

Hi,

Requiring passwords in tests that don't test the login is unnecessary and
binds them too tightly to implementation that they don't care about.

I suggest something like the following:

      def login_user(self, user):
          if not 'django.contrib.sessions' in settings.INSTALLED_APPS:
              raise AssertionError("Unable to login without django.contrib.sessions in INSTALLED_APPS")
          user.backend = "%s.%s" % ("django.contrib.auth.backends",
                                    "ModelBackend")
          engine = import_module(settings.SESSION_ENGINE)

          # Create a fake request to store login details.
          request = HttpRequest()
          if self.session:
              request.session = self.session
          else:
              request.session = engine.SessionStore()
          login(request, user)

          # Set the cookie to represent the session.
          session_cookie = settings.SESSION_COOKIE_NAME
          self.cookies[session_cookie] = request.session.session_key
          cookie_data = {
              'max-age': None,
              'path': '/',
              'domain': settings.SESSION_COOKIE_DOMAIN,
              'secure': settings.SESSION_COOKIE_SECURE or None,
              'expires': None,
          }
          self.cookies[session_cookie].update(cookie_data)

          # Save the session values.
          request.session.save()

refactoring with the common code in other methods.

That would allow you to just login with a User object.

Thanks,

James

[James Westby <jw+debian@…>]

Suggested approach

[James Westby <jw+debian@…>]

Attached the code as I messed up the formatting.

Thanks,

James

[Ramiro Morales]

Re-formatted description.

[Thomas Güttler]

I had this idea some time ago, but it was rejected. I hope this ticket has more luck than mine #5938

[Russell Keith-Magee]

Duplicate of #5938, which was previously wontfixed. If you want to make your case for this, start a discussion on django-dev and make your case.

For the record, I would argue that login() doesn't bind you to passwords. It binds you to the authentication mechanism of your stack, which is what the test client is testing.