I want to reset/unset the passwords of my users, they should be forced to use the "password reset", and set a new one, that validates with the new password validators.
I found Django docs, so set_unusable_password() is not an option, as the reset is not allowed afterwards. I found that using user.password = '' works - user cannot login, and password reset is working.
Still, this solution feels a bit awkward, and I cant find any real ressources on this topic - how is it security wise, etc.?
As the docs link you posted states: since Django 2.1 you should be able to use set_unusable_password and still request a password reset.
See https://docs.djangoproject.com/en/4.0/releases/2.1/#miscellaneous:
User.has_usable_password() and the is_password_usable() function no longer return False if the password is None or an empty string, or if the password uses a hasher that’s not in the PASSWORD_HASHERS setting. This undocumented behavior was a regression in Django 1.6 and prevented users with such passwords from requesting a password reset. Audit your code to confirm that your usage of these APIs don’t rely on the old behavior.
So if you are using Django <1.6 or >=2.1, it's probably safer to use the suggested way of setting a "None" password (which generates a "fake" hash that can never be a valid encoded hash).
For the Django versions in between, I would suggest ensuring that you never allow submitting an empty string to authenticate, since I think one could potentially log in this way.
