django-password-session 0.1

A reusable Django app that will invalidate all active sessions after change password.

Installation

1. Install a package.

$ pip install django-password-session

2. Add “password_session” to your INSTALLED_APPS setting:

INSTALLED_APPS = (
    ...
    'password_session',
)

3. Add middleware:

MIDDLEWARE_CLASSES = (
    ...
    'password_session.middleware.CheckPasswordHash',
),

4. Make sure that you have the following settings:

INSTALLED_APPS = (
    ...
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
)

AUTHENTICATION_BACKENDS = (
    ...
    'django.contrib.auth.backends.ModelBackend',
)

MIDDLEWARE_CLASSES = (
    ...
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
)

Settings

Default application settings can be overriden in settings.py:

PASSWORD_SESSION_PASSWORD_HASH_KEY = 'password_session_password_hash_key' #  default key stored in session
PASSWORD_SESSION_PASSWORD_HASH_LENGTH = 4 #  default key length

Requirements

• Python 2.6+ or 3+

• Django 1.3+