Registry /
web-framework / django-rest-passwordreset
Install & Compatibility
Where this runs
tested against v1.5.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 18.1MB
glibcpy 3.10–3.920 runs
installs and imports cleanly · install 1.5s · import 0.000s · 19MB
16MB installed
● package 16MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
django_rest_passwordreset
✓ import django_rest_passwordreset
✗ django_rest_passwordreset
To set up django-rest-passwordreset, you need to add it to your `INSTALLED_APPS`, include its URLs in your project's `urls.py`, and crucially, implement a receiver function for the `reset_password_token_created` signal to send the password reset email. Without this signal handler, no emails will be sent, and users won't receive their reset links. Replace the example URL and email content with your actual frontend reset page URL and email templates.
# settings.py
INSTALLED_APPS = [
# ...
'rest_framework',
'django_rest_passwordreset',
]
# urls.py
from django.urls import path, include
from django.dispatch import receiver
from django.template.loader import render_to_string
from django.core.mail import EmailMultiAlternatives
from django_rest_passwordreset.signals import reset_password_token_created
urlpatterns = [
# ...
path('api/password_reset/', include('django_rest_passwordreset.urls', namespace='password_reset')),
]
# signals.py (or anywhere appropriate in your app)
@receiver(reset_password_token_created)
def password_reset_token_created(sender, instance, reset_password_token, *args, **kwargs):
"""
Handles password reset tokens
When a token is created, an e-mail needs to be sent to the user
"""
# Example: Render HTML email content and send
context = {
'current_user': reset_password_token.user,
'username': reset_password_token.user.username,
'email': reset_password_token.user.email,
'reset_password_url': "{}?token={}".format(
instance.request.build_absolute_uri('/reset-password/confirm/'),
reset_password_token.key
)
}
# In a real app, you'd render a proper template
email_html_message = render_to_string('email/user_reset_password.html', context)
email_plaintext_message = render_to_string('email/user_reset_password.txt', context)
msg = EmailMultiAlternatives(
# title:
f"Password Reset for {reset_password_token.user.username}",
# message:
email_plaintext_message,
# from:
os.environ.get('DEFAULT_FROM_EMAIL', 'noreply@example.com'),
# to:
[reset_password_token.user.email]
)
msg.attach_alternative(email_html_message, "text/html")
msg.send()
# Example template content for 'email/user_reset_password.html' and '.txt' would be required.
# For running this quickstart example, ensure you have an SMTP server configured for Django.
Debug
Known issues
breakingVersion 1.2.0 introduced significant breaking changes by dropping support for Python 2.7, Python 3.4, Django < 2.2, and Django REST Framework < 3.10. Ensure your project meets these minimum requirements.fixUpgrade your Python, Django, and Django REST Framework versions to meet or exceed the requirements: Python >= 3.6, Django >= 2.2, DRF >= 3.10. Then upgrade django-rest-passwordreset.
affects: <1.2.0
gotchaThe library does not send password reset emails by default. You MUST implement a signal receiver for `reset_password_token_created` to handle email sending.fixCreate a `signals.py` file in one of your Django apps (or similar location) and register a function to listen for the `reset_password_token_created` signal. This function will be responsible for composing and sending the email with the reset token. Refer to the quickstart example.
affects: All versions
gotchaBy default, requests to the password reset endpoint with an unknown email address will still return a 200 OK response to prevent information leakage (i.e., revealing valid user emails).fixIf you require a different behavior (e.g., returning a 400 or 404 for non-existent emails), you can configure this in your Django settings using `DJANGO_REST_PASSWORDRESET_ANONYMOUS_VIEWS_RETURN_200_FOR_INVALID_USER_EMAIL = False`. Be aware of the security implications.
affects: All versions (configurable since 1.1.0rc2)
gotchaProjects using UUIDs as the primary key for their User model might encounter issues in versions prior to 1.5.0.fixUpgrade to version 1.5.0 or later, which includes specific test cases and fixes to ensure compatibility with UUID primary keys for the User model.
affects: <1.5.0
Upgrade
Version history
1.5.0latest on PyPI · released Nov 5, 2024
Audit
Dependencies
DjangorequiredCore framework requirement, typically >=3.2, <5.0 for v1.5.0.
djangorestframeworkrequiredExtension for DRF, typically >=3.10, <4.0 for v1.5.0.