I'm creating a verification email users app, which as the name may suggest verify users' emails before activating their accounts.
I've seen in many tutorials that they use the following code to create a custom token generator for account activation:
class AccountActivationTokenGenerator(PasswordResetTokenGenerator):
def _make_hash_value(self, user, timestamp):
return text_type(user.is_active) + text_type(user.pk) + text_type(timestamp)
token_generator = TokenGenerator()
However, I don't see why I should use this over the default PasswordResetTokenGenerator.
I've tried to implement both, the custom and the default and the result is the same. Why do they suggest inheriting PasswordResetTokenGenerator and create an AccountActivationTokenGenerator.
Is there any security issue if I use the same token generator for two tasks?