Django two factor auth for Django social auth
App connecting django-two-factor-auth and social-app-django. If user authenticates through social auth, he will be enforced to go through 2FA (if he has 2FA enabled).
Documentation
The full documentation is at https://dj-two-factor-social-auth.readthedocs.io.
Quickstart
We expect, that you have already installed and configured django-two-factor-auth and social-app-django according to their documentation.
Install Django two factor auth for Django social auth:
pip install dj-two-factor-social-auth
Add it to your INSTALLED_APPS:
INSTALLED_APPS = (
...
"two_factor",
"social_django",
"social_2fa",
...
)Add Django two factor auth for Django social auth’s URL patterns:
from django.urls import path
urlpatterns = [
...
path("", include("social_2fa.urls")),
...
]Add social_2fa to your social pipeline in settings.py:
SOCIAL_AUTH_PIPELINE = (
...
"social_2fa.social_pipeline.two_factor_auth",
)Running Tests
Does the code actually work?
source <YOURVIRTUALENV>/bin/activate (myenv) $ pip install tox (myenv) $ tox
Development commands
pip install -r requirements_dev.txt invoke -l
History
1.0.3 (2026-10-29)
Security fix: the session flag recording a completed 2FA step was never cleared and was not tied to the user who completed it, so a session that had passed 2FA once could finish a social login as another account without that account’s OTP step. The flag is now bound to the user and to the challenged partial pipeline, and is consumed on the next pass of the pipeline step.
Fix: the OTP page answered 500 when no social login was waiting for it (a refreshed tab, the back button, an expired login). It now redirects to LOGIN_URL.
Tested on Django 6.0 and 6.1, Python 3.14 and 3.15, and social-auth-app-django 7
1.0.2 (2026-08-27)
Fix: take the session from the strategy instead of the pipeline’s request keyword argument, which social-auth-core 5.x overwrites with the request data when it resumes a partial pipeline (breaking the OTP round trip)
1.0.1 (2025-05-19)
Fix: session transfer of data
1.0.0 (2025-05-15)
Use session to transfer data (safer, more reliable)
Update support up to Django 5.2, Python 3.13 versions
Drop support for Python 3.8, Django 4.0 and below
0.1.2 (2023-03-09)
Try to rename package to be compatible with poetry (https://github.com/python-poetry/poetry/issues/6996)
0.1.1 (2023-03-08)
Update testing and setup.py to support newest Django, Python and django-two-factor-auth
0.1.0 (2022-03-21)
First release on PyPI.
1 maintainer
Metadata
1 maintainer
Release files for dj-two-factor-social-auth 1.0.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| dj_two_factor_social_auth-1.0.3.tar.gz | 22.0 kB | Without provenance | Details for dj_two_factor_social_auth-1.0.3.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| dj_two_factor_social_auth-1.0.3-py3-none-any.whl | Python 3 | none | any | Details for dj_two_factor_social_auth-1.0.3-py3-none-any.whl |
Total release size: 31.7 kB
Security for dj-two-factor-social-auth 1.0.3
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
