Password Reset

Goal for this part

Let users recover access when they forget a password. You will wire Django’s password-reset views, templates for each step, and—for local learning—the console email backend so reset links print in the terminal.

After this snapshot, you can request a reset, copy the link from the server console, and set a new password without admin intervention.

What you should already know

Login and logout views from earlier parts are the main prerequisite. You should understand that reset tokens must be secret and short-lived.

Real deployments need a real email backend (SMTP or an API). The console backend is only for development demos.

Concepts: reset views and email backends

Django ships a chain of views: request reset, email sent notice, token link confirmation, and done. You mostly supply templates and URL names.

Set EMAIL_BACKEND to console in development so messages print in the runserver terminal. Set DEFAULT_FROM_EMAIL to a sensible label for Campus Press.

# settings.py (development)
EMAIL_BACKEND = "django.core.mail.backends.console.EmailBackend"
DEFAULT_FROM_EMAIL = "Campus Press <[email protected]>"

# urls.py (pattern)
path(
    "password-reset/",
    auth_views.PasswordResetView.as_view(
        template_name="users/password_reset.html"
    ),
    name="password_reset",
),

Walkthrough: complete the flow

From the login page, follow Forgot password, submit an account email, and watch the terminal for the email body. Open the link, enter a new password twice, then log in with it.

Invalid emails typically still show a success page—that is intentional so sites do not leak which addresses exist. For teaching, use an email that belongs to a real user in your database.

How to run it and what you should see

Run 11-Password-Reset, trigger a reset for your user, copy the link from the console email, and complete the form. Old passwords should stop working afterward.

git clone https://github.com/michaeldunga1/fcc-django-blog.git
cd fcc-django-blog/11-Password-Reset
python3 -m venv .venv
source .venv/bin/activate
pip install -r ../requirements.txt
python manage.py migrate
python manage.py runserver

Common mistakes and troubleshooting

If no email appears, confirm the console backend setting and that you submitted an email matching a user. If the link 404s, check that all four reset URL patterns are included with the expected names.

Token errors after restarting with a changed SECRET_KEY are expected—tokens are signed with the project secret.

Try this checklist

• Request a reset and find the link in the terminal
• Complete the reset and log in with the new password
• Confirm the old password fails
• Note what you would change for real SMTP later