title: Django bad request 400?
body: <p>I have read many questions on SO regarding error code 400 and understood that the issue is mainly when the client does not send the json, the api is expecting. However, I am not able to get around my error code 400 issue. I am following <a href="https://thinkster.io/django-angularjs-tutorial" rel="nofollow">this thinkster djangular</a> tutorial, In registering new users section, I am hitting bad request 400. </p>
  
  <p>views.py</p>
  
  <pre><code>from rest_framework import permissions, viewsets, status
  from rest_framework.response import Response
  
  from authentication.models import Account
  from authentication.permissions import IsAccountOwner
  from authentication.serializers import AccountSerializer
  
  
  class AccountViewSet(viewsets.ModelViewSet):
      lookup_field = 'username'
      queryset = Account.objects.all()
      serializer_class = AccountSerializer
  
      def get_permissions(self):
          if self.request.method in permissions.SAFE_METHODS:
              return (permissions.AllowAny(),)
  
          if self.request.method == 'POST':
              return (permissions.AllowAny(),)
  
          return (permissions.IsAuthenticated(), IsAccountOwner(),)
  
      def create(self, request):
          serializer = self.serializer_class(data=request.data)
  
          if serializer.is_valid():
              Account.objects.create_user(**serializer.validated_data)
  
              return Response(serializer.validated_data, status=status.HTTP_201_CREATED)
  
          return Response({
              'status': 'Bad request',
              'message': 'Account could not be created with received data.'
          }, status=status.HTTP_400_BAD_REQUEST)
  </code></pre>
  
  <p>Is the create method up here supposed to override the create method in CreateModelMixin Class?</p>
  
  <p>Here is my serializers.py</p>
  
  <pre><code>from django.contrib.auth import update_session_auth_hash
  
  from rest_framework import serializers
  
  from authentication.models import Account
  
  
      class AccountSerializer(serializers.ModelSerializer):
          password = serializers.CharField(write_only=True, required=False)
          confirm_password = serializers.CharField(write_only=True, required=False)
  
          class Meta:
              model = Account
              fields = ('id', 'email', 'username', 'created_at', 'updated_at',
                        'first_name', 'last_name', 'tagline', 'password',
                        'confirm_password',)
              read_only_fields = ('created_at', 'updated_at',)
  
              def create(self, validated_data):
                  return Account.objects.create_user(**validated_data)
  
              def update(self, instance, validated_data):
                  instance.username = validated_data.get('username', instance.username)
                  instance.tagline = validated_data.get('tagline', instance.tagline)
  
                  instance.save()
  
                  password = validated_data.get('password', None)
                  confirm_password = validated_data.get('confirm_password', None)
  
                  if password and confirm_password and password == confirm_password:
                      instance.set_password(password)
                      instance.save()
  
                  update_session_auth_hash(self.context.get('request'), instance)
  
                  return instance
  </code></pre>
  
  <p><em>When you create an object using the serializer's .save() method, the object's attributes are set literally. This means that a user registering with the password 'password' will have their password stored as 'password'. This is bad for a couple of reasons: 1) Storing passwords in plain text is a massive security issue. 2) Django hashes and salts passwords before comparing them, so the user wouldn't be able to log in using 'password' as their password.
  We solve this problem by overriding the .create() method for this viewset and using Account.objects.create_user() to create the Account object.</em></p>
  
  <p>Really clueless on whats going on...</p>