One can use Custom User Models for things like email logins. I've done this in a few projects and it works great. More info: https://docs.djangoproject.com/en/1.8/topics/auth/customizin...

I think a bigger issue with regards to usernames and email is the fact that neither are titlecased before getting indexed. I get that there are certain legacy considerations or whatever, but it really seems like there should at least be a note in the documentation about this given the massive clusterfuck that would potentially ensue should someone not figure this out before launching.

Do you mean that usernames/emails aren't normalised to a single case to prevent "duplicates" of "jarshwah" and "Jarshwah"? If so, this was recently brought up on the mailing list: https://groups.google.com/forum/#!topic/django-developers/SW...

I agree this should probably have a solution or at least documentation to be wary of.

Yeah, I actually hadn't seen that, but I know there are also longstanding tickets for this. I actually don't like the solutions in those threads, I think better to just add an extra field to the models, so have something like 'db_email' and 'display_email'. I realize you can do this with a functional index or whatever, but I think that's actually kind of hacky given the lack of ORM support for functional indexes.

My big issue with the current state though is that if you're relying on usernames or email addresses being unique then you're potentially opening yourself up to all sorts of security issues without realizing it.

FWIW I agree the solutions in that thread aren't good enough, especially since most of them are postgres specific. Now that migrations can be shipped with contrib.auth, a better solution might be possible.

I'd probably prefer a functional unique index since it would be easier to maintain (rather than duplicate fields). We just need to get expression support into indexes.

Well, I hear there's this expressions API and that now it's possible to use them during the initial creation/save of an object... maybe there's some normalization people could do with that :)

Do you know how well cookiecutter-django [0] handles email logins? I've been meaning to play around with cookiecutter, but I haven't started a new project recently. Cookiecutter uses django-allauth [1], which seems to offer email login methods, from what I see in a cursory look at the docs [2].

[0] - https://github.com/pydanny/cookiecutter-django

[1] - https://github.com/pennersr/django-allauth

[2] - http://django-allauth.readthedocs.org/en/latest/configuratio...

I asked pydanny on twitter and he says yes, thanks to django-allauth. Requires a setting in your settings.py file and it should just work.

It's comforting to know that I'm not the only one who struggled to get email-based authentication working in Django. It had me feeling totally incompentent a few weeks ago and I ended up implementing something very hackish to set the username equal to the email address.