[Python] Django bad request 400?

I have read many questions on SO regarding error code 400 and understood that the issue is mainly when the client does not send the json, the api is expecting. However, I am not able to get around my error code 400 issue. I am following this thinkster djangular tutorial, In registering new users section, I am hitting bad request 400.

views.py

from rest_framework import permissions, viewsets, status
from rest_framework.response import Response

from authentication.models import Account
from authentication.permissions import IsAccountOwner
from authentication.serializers import AccountSerializer


class AccountViewSet(viewsets.ModelViewSet):
lookup_field = 'username'
queryset = Account.objects.all()
serializer_class = AccountSerializer

def get_permissions(self):
if self.request.method in permissions.SAFE_METHODS:
return (permissions.AllowAny(),)

if self.request.method == 'POST':
return (permissions.AllowAny(),)

return (permissions.IsAuthenticated(), IsAccountOwner(),)

def create(self, request):
serializer = self.serializer_class(data=request.data)

if serializer.is_valid():
Account.objects.create_user(**serializer.validated_data)

return Response(serializer.validated_data, status=status.HTTP_201_CREATED)

return Response({
'status': 'Bad request',
'message': 'Account could not be created with received data.'
}, status=status.HTTP_400_BAD_REQUEST)


Is the create method up here supposed to override the create method in CreateModelMixin Class?

Here is my serializers.py

from django.contrib.auth import update_session_auth_hash

from rest_framework import serializers

from authentication.models import Account


class AccountSerializer(serializers.ModelSerializer):
password = serializers.CharField(write_only=True, required=False)
confirm_password = serializers.CharField(write_only=True, required=False)

class Meta:
model = Account
fields = ('id', 'email', 'username', 'created_at', 'updated_at',
'first_name', 'last_name', 'tagline', 'password',
'confirm_password',)
read_only_fields = ('created_at', 'updated_at',)

def create(self, validated_data):
return Account.objects.create_user(**validated_data)

def update(self, instance, validated_data):
instance.username = validated_data.get('username', instance.username)
instance.tagline = validated_data.get('tagline', instance.tagline)

instance.save()

password = validated_data.get('password', None)
confirm_password = validated_data.get('confirm_password', None)

if password and confirm_password and password == confirm_password:
instance.set_password(password)
instance.save()

update_session_auth_hash(self.context.get('request'), instance)

return instance


When you create an object using the serializer's .save() method, the object's attributes are set literally. This means that a user registering with the password 'password' will have their password stored as 'password'. This is bad for a couple of reasons: 1) Storing passwords in plain text is a massive security issue. 2) Django hashes and salts passwords before comparing them, so the user wouldn't be able to log in using 'password' as their password. We solve this problem by overriding the .create() method for this viewset and using Account.objects.create_user() to create the Account object.

Really clueless on whats going on...

Continue reading...