EmailAuth pipeline - saving password

[sid24ss]

Okay, I'm a little confused.

I don't want to create a user unless they have validated the email. So my social.pipeline.user.create_user comes after social.pipeline.mail.mail_validation.

I have a custom form for users to sign up with, so I'm setting only the SOCIAL_AUTH_EMAIL_FORM_URL setting. The form submits to complete/email, and that is how the whole pipeline starts. I take all the details (name, email and password) in this form itself.

So now, where should the save_password function go in the pipeline?

If it goes after mail_validation, the issue is that the password is not set in the session.

If it goes before mail_validation, since create_user comes after it, there is no user, so for new users, the user keyword is None, which means there is no set_password for it.

What's the standard way of doing this?

[omab]

You should store the password in the session when you get it the first time, then retrieve it and set it once the user was created, so you need a new pipeline function after create_user that will get that password from the session and set it in the newly created instance.

[sid24ss]

But isn't that a hack? What if the user signs up and then doesn't check
her mail in the same session?

Siddharth Swaminathan
Sent from my mobile device,
please excuse any brevity.
On Mar 21, 2014 12:51 AM, "Matías Aguirre" notifications@github.com wrote:

You should store the password in the session when you get it the first
time, then retrieve it and set it once the user was created, so you need a
new pipeline function after create_user that will get that password from
the session and set it in the newly created instance.

Reply to this email directly or view it on GitHubhttps://github.com//issues/222#issuecomment-38249076
.

[omab]

Yeah, that's possible, the user could easily clean the cookies, but it's just an example on how you can manipulate the pipeline, other options could be:

• ask for the password after the email validation was complete (partial pipeline)
• store the initial password in a new table in your server, or in another storage like redis or memcached (beware of memcached restarts)
• create the user when the data in available but set it as inactive and remove the flag once the email is validated (that way the user can't login unless the email is validated)

[sid24ss]

Yeah, I thought about points 1 and 3. I'll look into this. Thanks a lot,
just wanted to make sure there's no feature I'm missing.

I'm closing this for now.

On Fri, Mar 21, 2014 at 1:47 AM, Matías Aguirre notifications@github.comwrote:

Yeah, that's possible, the user could easily clean the cookies, but it's
just an example on how you can manipulate the pipeline, other options could
be:

• ask for the password after the email validation was complete
  (partial pipeline)
• store the initial password in a new table in your server, or in
  another storage like redis or memcached (beware of memcached restarts)
• create the user when the data in available but set it as inactiveand remove the flag once the email is validated (that way the user can't
  login unless the email is validated)

Reply to this email directly or view it on GitHubhttps://github.com//issues/222#issuecomment-38250752
.

Siddharth Swaminathan
http://siddharthswaminathan.in/