Username email address part is case sensitive

[m.gajda@…]

I've discovered that create_user from User model manager (auth contrib module) lowercases newly created user's email address. The RFC document says, that only domain part of email address is case insensitive, so I think that lowercasing the username part is a bug. See RFC 821 and RFC 1035.

Please correct it, by lowercasing only domain name part of email address.

[drowe]

Patch for lowercasing domain, but leaving user unchanged.

[drowe]

Please see the attached patch. I'm new to Django / Python development, but it does work. Hopefully it doesn't cause too much heartburn. The patch lowercases the domain section, but leaves the user / account information unchanged.

[drowe]

Changing status. Is this something the core devs want in the code? How many mail clients / MTAs adhere to the RFC on case-sensitivity?

[Malcolm Tredinnick]

Yes, we should apply this. There are plenty of MTA's out there that still match in a case-sensitive fashion (I've even inadvertently set up a few in that fashion -- cyrus-imap works like that out of the box, for example).

[Leo Shklovskii]

more pythonic fix, along with tests and doc changes

[Leo Shklovskii]

I've added a more pythonic patch along with a unit test and a documentation change to note the behavior.

[Chris Beaven]

Reviewing the patch, I see that it's going to fall over if the user doesn't pass in an email address with an '@' (e.g. an empty string).

>>> a, b = ''.split('@', 1)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ValueError: need more than 1 value to unpack

[Brodie Rao]

Updated to work with email addresses without at signs, including a test for that case

[Brodie Rao]

Also, I should note that the '@'.join() call happily works with unicode objects. I removed the Unicode test in the patch thinking it wasn't relevant, but I can see how it might have been an issue.

[Leo Shklovskii]

Thanks brodie, removing needs better patch flag.

[Leo Shklovskii]

revised patch against r12623

[Leo Shklovskii]

I've just updated this patch to work against the current trunk. It would be great to get it merged in before 1.2.

[Jacob]

(In [12641]) Fixed #5605: only lowercase the domain portion of an email address in UserManager.create_user.

Thanks, Leo.

[Jacob]

(In [12642]) [1.1.X] Fixed #5605: only lowercase the domain portion of an email address in UserManager.create_user.

Thanks, Leo.

Backport of [12641] from trunk.

[erikwright]

Out of curiosity, why is it important to lowercase even the domain? Users are not aware of or interested in these case-sensitivity rules but probably expect to see the case that they entered preserved.

In fact, this causes an issue for a Digest authentication package that I maintain (​http://bitbucket.org/akoha/django-digest/). We wish to allow users to authenticate via Digest auth using their username or a verified email address. We need to pre-calculate partial digests for all possible (case-sensitive) logins. If a user signs up with the email address 'SomeUser@Example.com' we want to allow them to authenticate with either the user supplied case OR the lower case version.

If the user-supplied case is discarded by Django we must keep our own copy in order to support this behaviour.

At the moment the only Digest client we support is in-house, so that client forcibly lowercases logins, avoiding this problem. But as we begin supporting other clients, this may be an issue. And I don't understand why it would ever be important to store the lower case domain name.

[Jacob]

Milestone 1.2 deleted