Skip to main content

Hide your Django site behind basic authentication mechanism with IP whitelisting support.

Project description

GitHub actions CI status

This simple package ships middleware that lets you to set basic authentication and IP whitelisting via Django settings.

Use case

This package has been created for staging and demo sites that need to be completely hidden from the Internet behind a password or accessible only to certain IP networks.

Do not depend on this package to protect highly valuable information. This package is at a good way to disable staging sites being discovered by search engines and Internet users trying to access staging sites. It is advised that any sensitive information is protected using Django authentication system.


  • Django 1.8, 1.9, 1.10, 1.11, 2.0, 2.1, 2.2 or 3.0.

  • Python 3.4, 3.5, 3.6, 3.7 or 3.8.


The package is on PyPI so you can just install it with pip.

pip install django-basic-auth-ip-whitelist


In your Django settings you can configure the following settings:


Credentials that you want to use with your basic authentication.


Set a list of network ranges (strings) compatible with Python’s ipaddress.ip_network that you want to be able to access the website without authentication from. It must be either a string with networks separated by comma or Python iterable.

Warning: See [Getting IP Address](#getting-ip-address) below for caveats around IP address detection.


String specifying the realm of the default response.

Example settings

BASIC_AUTH_LOGIN = 'somelogin'
BASIC_AUTH_PASSWORD = 'greatpassword'

Advanced customisation

Getting IP Address

By default, BasicAuthIPWhitelistMiddleware uses request.META["REMOTE_ADDR"] as the client’s IP, which corresponds to the IP address connecting to Django. If you have a reverse proxy (eg nginx in front), this will result in the IP address of nginx, not the client.

Correctly determining the IP address can vary between deployments. Guessing incorrectly can result in security issues. Instead, this library requires you configure this yourselves.

In most deployments, the X-Forwarded-For header can be used to correctly determine the client’s IP. We recommend django-xff to help parse this header correctly. Because django-xff overrides REMOTE_ADDR by default, it is natively supported by BasicAuthIPWhitelistMiddleware.

django-ipware is another popular library, however may take more customization to implement.

To fully customize IP address detection, you can set BASIC_AUTH_GET_CLIENT_IP_FUNCTION to a function which takes a request and returns a valid IP address:

BASIC_AUTH_GET_CLIENT_IP_FUNCTION = 'utils.ip.get_client_ip'


Set a list of hosts that your website will be open to without basic authentication. This is useful if your website is hosted under multiple domains and you want only one of them to be publicly visible, e.g. by search engines.

This is by no means a security feature. Please do not use to secure your site.



Set a list of paths that your website will serve without basic authentication. This can be used to support API integrations for example with third-party services which don’t support basic authentication.

Paths listed in the setting BASIC_AUTH_WHITELISTED_PATHS are treated as roots, and any subpath will be whitelisted too. For example:


This will open up the path, as well as anything below it, e.g.


If you want to display a different template on the 401 page, please use this setting to point at the template.



If you want to specify custom response class, you can do so with this setting. Provide the path as a string.

BASIC_AUTH_RESPONSE_CLASS = 'yourmodule.response.CustomUnathorisedResponse'


Set this setting to True if you want the Authorization HTTP header to not be deleted from the request object after it has been used by this package’s middleware.


Skip middleware

You can skip the middleware by setting _skip_basic_auth_ip_whitelist_middleware_check attribute on the request to True.

setattr(request, '_skip_basic_auth_ip_whitelist_middleware_check', True)

This may be handy if you have other middleware that you want to have co-existing different middleware that restrict access to the website.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

django_basic_auth_ip_whitelist-0.6.0.tar.gz (8.6 kB view hashes)

Uploaded Source

Built Distribution

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page