BUG: When a setting is not added to settings.py, no default is used and error is raised on startup or during usage

[babinos87]

Describe the bug
I have installed django-axes in my Django project:

# Without ipware
pip install django-axes

I have followed the instructions to configure it.

INSTALLED_APPS = [
    ...

    # Axes app can be in any position in the INSTALLED_APPS list.
    'axes',
]

...

AUTHENTICATION_BACKENDS = [
    # AxesStandaloneBackend should be the first backend in the AUTHENTICATION_BACKENDS list.
    'axes.backends.AxesStandaloneBackend',

    # Django ModelBackend is the default authentication backend.
    'django.contrib.auth.backends.ModelBackend',
]

...

MIDDLEWARE = [
    ...

    # AxesMiddleware should be the last middleware in the MIDDLEWARE list.
    # It only formats user lockout messages and renders Axes lockout responses
    # on failed user authentication attempts from login views.
    # If you do not want Axes to override the authentication response
    # you can skip installing the middleware and use your own views.
    'axes.middleware.AxesMiddleware',
]
...

and added some custom configuration in settings.py:

AXES_LOCKOUT_PARAMETERS = ["username"]
AXES_CLIENT_IP_CALLABLE = lambda x: None  # noqa: E731
AXES_FAILURE_LIMIT = 5
AXES_COOLOFF_TIME = 24

Now, when I ran my server, I got the below error:

AttributeError: 'Settings' object has no attribute 'AXES_CLIENT_STR_CALLABLE'. Did you mean: 'AXES_CLIENT_IP_CALLABLE'?

So I added to my settings.py:

AXES_CLIENT_STR_CALLABLE = lambda x: None  # noqa: E731

then I got a similar error for another setting, I had to add those in order to get the server up and running:

AXES_LOCKOUT_CALLABLE = lambda x: None  # noqa: E731
AXES_USERNAME_CALLABLE = lambda x: None  # noqa: E731
AXES_WHITELIST_CALLABLE = lambda x: None  # noqa: E731

Then I tried to test axes by performing a login. I use Django REST Framework with JWT authentication, so I am still in the process to figure out how axes will work with that, as it is not clear in the docs, perhaps I have to make customizations and patches. In any case, I would expect that the server would start anyway, and that I would either get some errors at some point or that axes just won't work.

But I got more configuration errors when trying to login:

AttributeError: 'Settings' object has no attribute 'AXES_ENABLED'

so I added it, then I got another error:

AttributeError: 'Settings' object has no attribute 'AXES_USERNAME_FORM_FIELD'

I paused here because I may be doing something wrong, or something else is wrong here?

I think that those defaults should not be re-defined by myself in settings.py, right? Why do I need to define them in order for the server to just start? Is this how this module works, or I have missed something? Or is this a bug?

NOTE: Those errors happen after axes (seems to be) initialized):

[07/Jul/2025 13:49:33] INFO [axes.apps:53] AXES: BEGIN version 8.0.0, blocking by username
[07/Jul/2025 13:51:31] INFO [axes.apps:53] AXES: BEGIN version 8.0.0, blocking by username
Performing system checks...
...

and the actual exception:

Traceback (most recent call last):
  File "/usr/local/lib/python3.11/threading.py", line 982, in run
    self._target(*self._args, **self._kwargs)
  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/django/utils/autoreload.py", line 64, in wrapper
    fn(*args, **kwargs)
  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/daphne/management/commands/runserver.py", line 96, in inner_run
    self.check(display_num_errors=True)
  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/django/core/management/base.py", line 486, in check
    all_issues = checks.run_checks(
                 ^^^^^^^^^^^^^^^^^^
  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/django/core/checks/registry.py", line 88, in run_checks
    new_errors = check(app_configs=app_configs, databases=databases)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/axes/checks.py", line 176, in axes_conf_check
    value = getattr(settings, callable_setting)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/django/conf/__init__.py", line 83, in __getattr__
    val = getattr(_wrapped, name)
          ^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'Settings' object has no attribute 'AXES_CLIENT_STR_CALLABLE'. Did you mean: 'AXES_CLIENT_IP_CALLABLE'?

Thanks!

To Reproduce
Steps to reproduce the behavior:

1. Install Django axes
2. Start Django server

Expected behavior
Server should start without errors.

Your environment
python version: 3.11.10
django version: 5.1.11
django-axes version: 8.0.0
Operating system: Ubuntu 24.04 LTS

[babinos87]

Looks like there is no default value used in here?

If this is indeed the reason, it could be fixed just be changing this:

    callable_settings = [
        "AXES_CLIENT_IP_CALLABLE",
        "AXES_CLIENT_STR_CALLABLE",
        "AXES_LOCKOUT_CALLABLE",
        "AXES_USERNAME_CALLABLE",
        "AXES_WHITELIST_CALLABLE",
        "AXES_COOLOFF_TIME",
        "AXES_LOCKOUT_PARAMETERS",
    ]

to a list of tuples, where the element in position 1 would be a default callable, so it would be like:

    callable_settings = [
        ...
        ("AXES_CLIENT_IP_CALLABLE", lambda x: None)
        ...
    ]

and then

    for callable_setting, callable_default in callable_settings:
        value = getattr(settings, callable_setting, callable_default)

I could submit a with this change, if you advise this is the right thing to do to fix that. Perhaps I am completely mistaken though, I just tried to use this project for the first time.

EDIT: Actually I am not sure if this will solve the issue. After I defined some defaults and tried to utilize django-axes, I get this error during a login call:

  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/django/views/decorators/debug.py", line 75, in sensitive_variables_wrapper
    return func(*func_args, **func_kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/django/contrib/auth/__init__.py", line 79, in authenticate
    user = backend.authenticate(request, **credentials)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/axes/helpers.py", line 617, in inner
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/axes/backends.py", line 52, in authenticate
    if AxesProxyHandler.is_allowed(request, credentials):
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/axes/handlers/proxy.py", line 108, in is_allowed
    return cls.get_implementation().is_allowed(request, credentials)
           ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/axes/handlers/proxy.py", line 46, in get_implementation
    cls.implementation = import_string(settings.AXES_HANDLER)()
                                       ^^^^^^^^^^^^^^^^^^^^^
  File "/home/myuser/.virtualenvs/myVenv311/lib/python3.11/site-packages/django/conf/__init__.py", line 83, in __getattr__
    val = getattr(_wrapped, name)
          ^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'Settings' object has no attribute 'AXES_HANDLER'

So it looks like another default is not set properly? Do I need to re-define all defaults?

These errors persist when I downgraded axes to 7.x. So I think I may have missed something, as this can't be in a non-working state by default for such a long period?