Increasing Django login security and password strengths

Question

When I create the Django superuser , if I try to add a weak password Django doesn't let me, but for normal users, in admin, or using register form I can add very simple password.

1. How can I ad the password validation from the superuser creation to all users ?
2. Can the number of login bad tries be limited (I prefer without third-party)

Answer 1

When creating users or super users alike both use the same Django configuration settings AUTH_PASSWORD_VALIDATORS and if left unmodified it'll contain a list of validators that all passwords will validate against when creating users via Django admin. This is also the place where you strengthen your validators by adding more if you want harder or remove if you want to be more lax.

However, if you're creating users via the management commands create_user and create_superuser this list of validators will not apply. This is because Django assumes that only developers are interacting with Django at this level.

For your second ask, there is nothing built-in to Django that supports login tries and following blocking of further logins. This is something that either comes from 3rd party apps such as django-defender or from own implementation.

The broad strokes of that implementation is

1. Add a new tablemechanism that stores number of tries

2. Add a new settings in settings.py LOGIN_ATTEMPTS = 3

3. Override the login flow for a user in which you check this table for attempts
4. If failed attempt increment counter, if successful reset counter.
5. If user hits the limit of attempts, set users is_active to False and always return False from your login override.