Skip to content

Assert no-login password reset returns 403 from Django in container logs - #871

Merged
atodorov merged 2 commits into
masterfrom
assert-password-reset-403
Sep 3, 2026
Merged

Assert no-login password reset returns 403 from Django in container logs#871
atodorov merged 2 commits into
masterfrom
assert-password-reset-403

Conversation

@atodorov

@atodorov atodorov commented Sep 3, 2026

Copy link
Copy Markdown
Member

Extends the "NO LOGIN - /accounts/passwordreset/ displays 404" test phase with assertions against the web_no_login container logs:

  • nginx access log: verifies the upstream (Django) responded with 403 while the client-facing status is 404 (both captured via the custom log_format's $status $upstream_status fields)
  • Django log: verifies WARNING Forbidden (Permission denied): /accounts/passwordreset/ is emitted by django.request when PASSWORD_LOGIN_ENABLED=False

@atodorov
atodorov force-pushed the assert-password-reset-403 branch 2 times, most recently from bf1090b to 8ee7f28 Compare September 3, 2026 18:03
…=False

django.views.defaults.permission_denied is the 403 error handler and requires an 'exception' argument. Using it directly in a URLconf caused Django to call it as a view with only 'request', resulting in a 500 TypeError instead of a 403. Replace it with a CBV which raises PermissionDenied and goes through Django's standard handler403 machinery.
@atodorov
atodorov force-pushed the assert-password-reset-403 branch from 8ee7f28 to ea31e04 Compare September 3, 2026 18:29
@atodorov
atodorov merged commit 1a491f1 into master Sep 3, 2026
8 checks passed
@atodorov
atodorov deleted the assert-password-reset-403 branch September 3, 2026 19:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant