title: AutoRedirect user to change password screen in django
body: <p>I have a user profile model as below</p>
  
  <pre><code>class UserProfile(models.Model):
      user = models.OneToOneField(User)
      role = models.ForeignKey(Role)
      .........
      .........
      password_changed = models.DateTimeField(blank=True, null=True)
  </code></pre>
  
  <p>I have a <code>PASSWORD_EXPIRATION</code> setting in settings.py based on which i should redirect the user to password change screen, for example if the <code>password_changed</code> date for the user exceeds <code>PASSWORD_EXPIRATION</code> setting then redirect the user to password change screen</p>
  
  <p>So for now i have three conditions to implement</p>
  
  <pre><code>1. If the password_changed date was empty,redirect the user to password change screen
  2. If the password_changed date exists for the user and if it exceeds PASSWORD_EXPIRATION setting then redirect the user to password change screen
  3. Don't let the user access other screens/urls if the password expires/without changing the passwords and redirect to password change screen
  </code></pre>
  
  <p>For the first two points i have implemented in <code>login</code> method as below</p>
  
  <pre><code>def login(request):
      if request.method == 'POST':
          form = LoginForm(request.POST)
          if form.is_valid():
              username = form.cleaned_data['username']
              password = form.cleaned_data['password']
              user = authenticate(username = username, password = password)
              if user is not None and user.is_active:
                  try:
                      profile = UserProfile.objects.get(user=user)
                      # If password_changed date does not exists, redirect to password change screen
                      if not profile.password_changed:
                          auth_login(request, user)
                          return redirect('change_password')
                      # If password_changed date exists, calculate the expiry date and redirect accordingly
                      ..............
                      ..............
                      days_for_password_to_expire = int(settings.PASSWORD_EXPIREDAYS) - int(password_changed_from_now.days)
                      if days_for_password_to_expire &lt; 0:
                          auth_login(request, user)
                          request.session['expired'] = True
                          return redirect('change_password')
  </code></pre>
  
  <p>For the third point i have implemented the middileware class as below</p>
  
  <p><strong>middleware.py</strong></p>
  
  <pre><code>class AutoRedirect:
    def process_request(self, request):
      user = request.user
      try:
          if user:
              profile = UserProfile.objects.get(user=user)
              if profile.password_changed:
                  password_changed_from_now = timezone.now() - profile.password_changed
                  days_for_password_to_expire = int(settings.PASSWORD_EXPIREDAYS) - \
                                         int(password_changed_from_now.days)
                  if days_for_password_to_expire &lt; 0:
                      return redirect('change_password')
              else:
                  return redirect('change_password')
      except Exception as e:
          print e
  </code></pre>
  
  <p>With the above Middleware class i was getting the error as</p>
  
  <pre><code>This webpage has a redirect loop
  </code></pre>
  
  <h2>Terminal Output</h2>
  
  <pre><code>[18/Aug/2015 00:25:15] "GET /change_password/ HTTP/1.1" 302 0
  [18/Aug/2015 00:25:15] "GET /change_password/ HTTP/1.1" 302 0
  [18/Aug/2015 00:25:15] "GET /change_password/ HTTP/1.1" 302 0
  [18/Aug/2015 00:25:15] "GET /change_password/ HTTP/1.1" 302 0
  [18/Aug/2015 00:25:15] "GET /change_password/ HTTP/1.1" 302 0
  ................
  ................
  </code></pre>
  
  <p>I understand the problem that it was facing, but how can i avoid it in the middle class logic to check whether password_changed contains data and if it expires redirect to change password screen ? so that user's can't access any url on the site ?</p>