django-auth-events

Auth session event consumer for Django. Bridges event-driven session invalidation with JWT token validation.

Combines streambus (event consumption) with django-auth-external (token validation) to reject tokens whose sessions have been explicitly invalidated — without tight coupling between services.

how it works

One service publishes a SessionInvalidatedEvent to an event stream whenever a user's access changes. Each Django service runs consume_auth_events, which receives those events and stores the invalidation state in Django's cache. The AuthEventsMiddleware checks that state on every request.

Token validation and invalidation are both in the middleware — no Redis dependency in the library itself. The cache backend is whatever you configure in Django's CACHES setting.

install

pip install django-auth-events

setup

Add the middleware (replaces AuthExternalMiddleware from django-auth-external):

MIDDLEWARE = [
    ...
    "django_auth_events.middleware.AuthEventsMiddleware",
]

Configure auth and event settings:

AUTH_EXTERNAL = {
    "SECRET_KEY": "your-secret-key",
    "CLAIMS": ["user_id", "email"],
}

AUTH_EVENTS = {
    "STREAM": "auth:session:events",
    "GROUP": "my-service",
    "REDIS_URL": "redis://localhost:6379",
    "CACHE_TTL": 86400,
}

Configure the cache backend (Redis recommended for multi-process deployments):

CACHES = {
    "default": {
        "BACKEND": "django.core.cache.backends.redis.RedisCache",
        "LOCATION": "redis://localhost:6379",
    }
}

Run the consumer:

python manage.py consume_auth_events

events

Publish a SessionInvalidatedEvent from any service to invalidate a user's active tokens:

from django_auth_events import SessionInvalidatedEvent
from streambus import EventPublisher
from streambus.transports.redis_streams import RedisStreamsTransport
from streambus.config import RedisConfig

transport = RedisStreamsTransport(RedisConfig(url="redis://localhost:6379"))
publisher = EventPublisher(stream="auth:session:events", transport=transport)
publisher.publish(SessionInvalidatedEvent(event_type="session.invalidated", user_id="abc-123"))

configuration

license

MIT