def authenticate(self, request, username=None, password=None, **kwargs):
            .....
        if user.check_password(password) and self.user_can_authenticate(user):
                return user

而且user_can_authenticate函數如下:

    def user_can_authenticate(self, user):
        is_active = getattr(user, ‘is_active‘, None)
        return is_active or is_active is None

由此可知django2.1後也會對用戶的is_active進行判斷,如果is_active為false,則authticate也會返回None.

要解決以上問題,只要繼承django.contrib.auth.backends.ModelBackend類重寫authticate方法返回True即可,此出剛好有一個類實現了以上操作django.contrib.auth.backends.AllowAllUsersModelBackend.

AUTHENTICATION_BACKENDS = [‘django.contrib.auth.backends.AllowAllUsersModelBackend‘]

dajngo2.1用戶名和密碼都正確authticate返回None