Password reset: Cannot assign AnonymousUser to PasswordHistory.user

[benstroud]

In a test project (Django 1.11.20; DUA==2.1.0) I'm encountering the following issue after setting a new password in the context of a password reset ("forgot password"). I believe this indicates that the password change event history cannot be saved due to the user being anonymous in the token-based password reset context. Setting ACCOUNT_PASSWORD_USE_HISTORY to False allows the password reset workflow to complete successfully.

Environment:


Request Method: POST
Request URL: http://localhost:8000/account/password/reset/1-set-password/

Django Version: 1.11.20
Python Version: 2.7.15
Installed Applications:
['django.contrib.admin',
 'django.contrib.auth',
 'django.contrib.contenttypes',
 'django.contrib.sessions',
 'django.contrib.messages',
 'django.contrib.staticfiles',
 'django.contrib.sites',
 'bootstrap3',
 'bootstrapform',
 'account',
 'testproj']
Installed Middleware:
['django.middleware.security.SecurityMiddleware',
 'django.contrib.sessions.middleware.SessionMiddleware',
 'django.middleware.common.CommonMiddleware',
 'django.middleware.csrf.CsrfViewMiddleware',
 'django.contrib.auth.middleware.AuthenticationMiddleware',
 'django.contrib.messages.middleware.MessageMiddleware',
 'django.middleware.clickjacking.XFrameOptionsMiddleware',
 'account.middleware.LocaleMiddleware',
 'account.middleware.TimezoneMiddleware',
 'account.middleware.ExpiredPasswordMiddleware']



Traceback:

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/core/handlers/exception.py" in inner
  41.             response = get_response(request)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/core/handlers/base.py" in _get_response
  187.                 response = self.process_exception_by_middleware(e, request)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/core/handlers/base.py" in _get_response
  185.                 response = wrapped_callback(request, *callback_args, **callback_kwargs)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/views/generic/base.py" in view
  68.             return self.dispatch(request, *args, **kwargs)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/utils/decorators.py" in _wrapper
  67.             return bound_func(*args, **kwargs)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/views/decorators/debug.py" in sensitive_post_parameters_wrapper
  76.             return view(request, *args, **kwargs)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/utils/decorators.py" in bound_func
  63.                 return func.__get__(self, type(self))(*args2, **kwargs2)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/utils/decorators.py" in _wrapper
  67.             return bound_func(*args, **kwargs)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/views/decorators/cache.py" in _wrapped_view_func
  57.         response = view_func(request, *args, **kwargs)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/utils/decorators.py" in bound_func
  63.                 return func.__get__(self, type(self))(*args2, **kwargs2)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/account/views.py" in dispatch
  681.                     return super(PasswordResetTokenView, self).dispatch(*args, **kwargs)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/views/generic/base.py" in dispatch
  88.         return handler(request, *args, **kwargs)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/views/generic/edit.py" in post
  183.             return self.form_valid(form)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/account/views.py" in form_valid
  709.         self.create_password_history(form, self.request.user)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/account/views.py" in create_password_history
  120.                 password=make_password(password)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/db/models/manager.py" in manager_method
  85.                 return getattr(self.get_queryset(), name)(*args, **kwargs)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/db/models/query.py" in create
  392.         obj = self.model(**kwargs)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/db/models/base.py" in __init__
  555.                     _setattr(self, field.name, rel_obj)

File "/Users/ben/g/test_django/venv2/lib/python2.7/site-packages/django/db/models/fields/related_descriptors.py" in __set__
  216.                     self.field.remote_field.model._meta.object_name,

Exception Type: ValueError at /account/password/reset/1-set-password/
Exception Value: Cannot assign "<SimpleLazyObject: <django.contrib.auth.models.AnonymousUser object at 0x10e202dd0>>": "PasswordHistory.user" must be a "User" instance.