Django Password Resest Via Email
<p>I'm trying to implement password reset by sending an email to the user with a link which will redirect him/her to a new password form. </p>

<p>I took by example <a href="http://stackoverflow.com/questions/18928144/django-user-registration-password-reset-via-email">this question</a> and <a href="http://ruddra.com/2015/09/18/implementation-of-forgot-reset-password-feature-in-django/" rel="nofollow">this site</a>.</p>

<p>But my problem is a bit different. I don't have a local database containing the users, so I cannot perform operations over their attributes. I receive user data via an API (user id, user email, user password).</p>

<p>So, which is the best way to <strong>generate a unique link</strong> to send via email to user so that this link would <strong>tell me who the user is</strong> and allow me to <strong>reset his/her password</strong>? And also, how could I redirect it in <strong>urls.py</strong>?
I wish that this link could be used only a single time.</p>

<p>My views.py is like this:</p>

<pre><code>def password_reset_form(request):

if request.method == 'GET':
    form = PasswordResetForm()
else:
    form = PasswordResetForm(request.POST) 

    if form.is_valid():
        email = form.cleaned_data['email']

        content_dict = {
            'email': email,
            'domain': temp_data.DOMAIN,
            'site_name': temp_data.SITE_NAME,
            'protocol': temp_data.PROTOCOL,
            }

        subject = content_dict.get('site_name')+ ' - Password Reset'
        content = render_to_string('portal/password_reset_email.html', content_dict)
        send_mail(subject, content, temp_data.FIBRE_CONTACT_EMAIL, [email])

        return render(request, 'portal/password_reset_done.html', {'form': form,})

return render(request, 'portal/password_reset_form.html', {'form': form,})
</code></pre>

<p>And the template the e-mail I'm sending is:</p>

<pre><code>{% autoescape off %}

You're receiving this e-mail because we got a request to reset the password for your user account at {{ site_name }}.

Please go to the following page and choose a new password:

{% block reset_link %}
{{ protocol }}://{{ domain }}/[***some unique link***]
{% endblock %}

If you didn't request a password reset, let us know. 

Thank you.

The {{ site_name }} team.

{% endautoescape %}
</code></pre>

<p>Thanks, guys.</p>

<p>The problem is not to generate unique link, you need to store somewhere info about user id or email, and generated token. Otherwise you will not know which user should use which token. After user resets his password you can delete his record (his token). </p>

<p>You can write the most simple model even in sqlite, which basically could look like this:</p>

<pre><code>class UserTokens(model.Models):
    email = models.EmailField(max_length=50)
    token = models.CharField(max_length=50)
</code></pre>

<p>Afterwards when you send mail make something like this:</p>

<pre><code>def password_reset_form(request):

    #your logic here
    # form post

    usr, created = UserToken.objects.get_or_create(email=form.email)
    if usr.token:
        #send this token to him
     else:
        usr.token = ''.join(
    random.choice(string.ascii_uppercase + string.digits) for _ in range(50))
         usr.save()
         #also send this token to him
</code></pre>

<p>Then you create a new view or api view which searches for that token, if found, let him reset the password. If not, raise a 404 error, or just let him know that there is no such link to reset password.</p>

<p>Please not that, this was written from my phone so care for typos. </p>

<p>PS. you also asked about urls</p>

<p>just make something like this:</p>

<pre><code>url(r'unsubscribe/(?P&lt;quit_hash&gt;[\w\d]+)/$', 'quit_newsletter_or_somethin', name='quit_newsletter_or_somethin')
</code></pre>

python django django-forms