Disallow usernames that differ only in case in UserCreationForm

[Tim Graham]

Most applications don't treat user names as case sensitive. While we can't treat usernames as case-insensitive everywhere in Django due to backwards compatibility (#2273), by using username__iexact when checking for uniqueness of new usernames in UserCreationForm, we can at least prevent the creation of new usernames that differ only in case from an existing one. This protection won't cover creating a user in the shell or through the createsuperuser management command, but I don't think this is critical.

This wouldn't affect any usernames that already exist, and users will still need to login with the same case that they register with.

[Neven Munđar]

It's possible to achieve the effect described in this ticket by raising ValidationError in UserCreationForm.clean_username. However, this introduces one additional side-effect in tests of password validation logic. UserAttributeSimilarityValidator will not be able to check if username is similar to password because previously raised ValidationError will make username attribute None in password validator and "The password is too similar to the username." message will be missing from error list. Since the username in this case has to be changed anyway, omitting this message may not be relevant because password similarity check makes sense only on valid usernames. That's the explanation why auth_tests.test_forms.UserCreationFormTest.test_validates_password has to be tweaked in the patch.

[Tim Graham]

Are you able to convert the patch into a pull request?

[Neven Munđar]

PR: ​https://github.com/django/django/pull/5572

[Tim Graham]

There's a test failure.

[Neven Munđar]

It's fixed now, stupid mistake. Previous form data that I've used didn't trigger password length validation.

[Berker Peksag]

Looking at ​https://github.com/django/django/pull/5572 again, I'd suggest the following API:

• Adding a clean_username method would make UserCreationForm less subclass friendly. I'd suggest rename UserCreationForm to BaseUserCreationForm and document it as a preferred way to extend user creation form
• Add a clean_username method to UserCreationForm (it will be a subclass of BaseUserCreationForm)

Thoughts?

[Mariusz Felisiak]

​PR

[Mariusz Felisiak <felisiak.mariusz@…>]

In 298d02a7:

Fixed #25617 -- Added case-insensitive unique username validation in UserCreationForm.

Co-Authored-By: Neven Mundar <nmundar@…>