From 116f6f50855e11808aa8adac18182a053fbb66f0 Mon Sep 17 00:00:00 2001 From: muhamedfazalps Date: Tue, 23 Jun 2026 12:31:17 +0530 Subject: [PATCH] fix: use getattr for safe access to request.axes_attempt_time get_cool_off_threshold() declares request as Optional[HttpRequest] with a default of None, but the function body unconditionally dereferences request.axes_attempt_time, causing AttributeError when called without a request or with a request that hasn't gone through the axes failure-tracking path. Use getattr with a default of None to safely handle both cases. Fixes #1424 --- axes/attempts.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/axes/attempts.py b/axes/attempts.py index 830f07e7..1088703f 100644 --- a/axes/attempts.py +++ b/axes/attempts.py @@ -20,7 +20,7 @@ def get_cool_off_threshold(request: Optional[HttpRequest] = None) -> datetime: "Cool off threshold can not be calculated with settings.AXES_COOLOFF_TIME set to None" ) - attempt_time = request.axes_attempt_time # type: ignore[union-attr] + attempt_time = getattr(request, "axes_attempt_time", None) if attempt_time is None: return now() - cool_off return attempt_time - cool_off