AbstractBaseUser missing password validaton

[Fernando Miranda]

Using the new password validation framework, it looks like AbstractBaseUser does not call password validators defined in settings.py:

# django.contrib.auth.models.py

class AbstractBaseUser(models.Model):
    password = models.CharField(_('password'), max_length=128)  
    ...

I'd expect something like this in the above line:

class AbstractBaseUser(models.Model):
    password = models.CharField(_('password'), max_length=128, validators=validators_list())  

This issue is related to #25052, but I'm not sure.

[Tim Graham]

I'm not sure how/if that would work because the final value for password is the hashed password and that's not the one we want to validate. Can you describe or give example code of the case where you're seeing validation is missing?

[Fernando Miranda]

You are right Tim, I got confused by the fact that validation is made not only in Models but also in Forms and other places. Sorry for the noise.