Skip to content

Fix case sensitivity issue in username handling #1146

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

tdrivas
Copy link
Contributor

@tdrivas tdrivas commented Mar 10, 2025

This PR resolves an issue where Django Allauth was treating all usernames as lowercase during authentication, preventing users with capital letters in their usernames from logging in.

The problem
Usernames were correctly stored in the database with their original case (e.g., Bob), but authentication failed if users entered their names with uppercase letters.

Solution
Updated ACCOUNT_PRESERVE_USERNAME_CASING to True so to ensure usernames are not altered during authentication and are matched exactly as stored in the database.

Impact

  • Users can now login using the their, exact case, username as stored in the db.
  • No impact on existing stored usernames as only the authentication behavior has been adjusted.

Test new functionality (Manual tests)

  • Tested logging in with usernames having uppercase letters
  • Ensured that new users can sign up and log in as expected.
  • Verified password reset still works with case-sensitive usernames

@duke-nyuki
Copy link
Collaborator

@tdrivas tdrivas self-assigned this Mar 10, 2025
@tdrivas tdrivas requested review from suricactus and gounux March 10, 2025 05:07
Copy link
Collaborator

@suricactus suricactus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am only afraid what will be the implications of such change. Let us discuss in the next meeting.

Btw, would you mind adding the docs in settings file since you are on it?

@gounux
Copy link
Member

gounux commented Mar 11, 2025

Could test locally, auth with uppercases in the login username seems to work fine !

I am only afraid what will be the implications of such change

Feeling the same.

@suricactus
Copy link
Collaborator

@tdrivas let us know what tests you have performed to ensure no regressions are there.

@tdrivas
Copy link
Contributor Author

tdrivas commented Mar 11, 2025

@tdrivas let us know what tests you have performed to ensure no regressions are there.

Check updated description please!

@suricactus
Copy link
Collaborator

suricactus commented Mar 11, 2025

Test new functionality (Manual tests)
Tested logging in with usernames having uppercase letters
Ensured that new users can sign up and log in as expected.
Verified password reset still works with case-sensitive usernames

A few other manual tests on top of the ones you performed:

  • ensure usernames with lowercase letters can login
  • ensure that username "SURICACTUS" or similar can access their profile no matter if they are written in lowercase or uppercase in the login form for:
  • a) Django admin
  • b) app.qfiled.cloud login
  • ensure that after login, one can load host.com/a/SURICACTUS and host.com/a/suricactus with the same result.

I believe we can write a new test function similar to

with username with capitals.

@tdrivas tdrivas requested a review from suricactus March 18, 2025 08:46
@tdrivas tdrivas requested a review from suricactus March 18, 2025 18:46
Copy link
Collaborator

@suricactus suricactus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Last two bits and we are ready.

tdrivas added 2 commits March 18, 2025 22:55
…ess for clarity and group login-related tests together
…th_session_case_insensitive to the end of login tests
@tdrivas tdrivas requested a review from suricactus March 18, 2025 21:00
@suricactus
Copy link
Collaborator

I will leave this one for the next release. Not huge risk, but still sounds like an imporant settings we change.

@gounux gounux merged commit a26d126 into master Mar 26, 2025
20 checks passed
@gounux gounux deleted the QF-4962_Cannot_login_to_admin_if_the_username_starts_with_a_Capital_letter branch March 26, 2025 14:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants