django-pwned-passwords

https://codecov.io/gh/jamiecounsell/django-pwned-passwords/branch/master/graph/badge.svg

django-pwned-passwords is a Django password validator that checks Troy Hunt’s PWNED Passwords API to see if a password has been involved in a major security breach before.

Note: This app currently sends a portion of a user’s hashed password to a third party. Before using this application, you should understand how that impacts you.

Documentation

The full documentation is at https://django-pwned-passwords.readthedocs.io.

Requirements

Django [1.9, 2.1]
Python 2.7, [3.5, 3.6, 3.7]

Quickstart

Install django-pwned-passwords:

pip install django-pwned-passwords

Add it to your INSTALLED_APPS:

INSTALLED_APPS = (
    ...
    'django_pwned_passwords',
    ...
)

Add django-pwned-passwords’s PWNEDPasswordValidator:

AUTH_PASSWORD_VALIDATORS = [
    ...
    {
        'NAME': 'django_pwned_passwords.password_validation.PWNEDPasswordValidator'
    }
]

Features

This password validator returns a ValidationError if the PWNED Passwords API detects the password in its data set. Note that the API is heavily rate-limited, so there is a timeout (PWNED_VALIDATOR_TIMEOUT).

If PWNED_VALIDATOR_FAIL_SAFE is True, anything besides an API-identified bad password will pass, including a timeout. If PWNED_VALIDATOR_FAIL_SAFE is False, anything besides a good password will fail and raise a ValidationError.

Settings

Setting	Description	Default
`PWNED_VALIDATOR_TIMEOUT`	The timeout in seconds. The validator will not wait longer than this for a response from the API.	`2`
`PWNED_VALIDATOR_FAIL_SAFE`	If the API fails to get a valid response, should we fail safe and allow the password through?	`True`
`PWNED_VALIDATOR_URL`	The URL for the API in a string format.	`https://haveibeenpwned.com/api/v2/pwnedpassword/{short_hash}`
`PWNED_VALIDATOR_ERROR`	The error message for an invalid password.	`"Your password was determined to have been involved in a major security breach."`
`PWNED_VALIDATOR_ERROR_FAIL`	The error message when the API fails. Note: this will only display if `PWNED_VALIDATOR_FAIL_SAFE` is False.	`"We could not validate the safety of this password. This does not mean the password is invalid. Please try again later."`
`PWNED_VALIDATOR_HELP_TEXT`	The help text for this password validator.	`"Your password must not have been detected in a major security breach."`
`PWNED_VALIDATOR_MINIMUM_BREACHES`	The minimum number of breaches needed to raise an error	`1`

Rate Limiting

Historically, requests to the API were rate limited. However, with the new k-anonymity model-based API, there are no such rate limits.

Running Tests

source <YOURVIRTUALENV>/bin/activate
(myenv) $ pip install tox
(myenv) $ tox

Credits

Tools used in rendering this package:

History

See Github Releases

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

django-pwned-passwords-4.1.0.tar.gz (7.0 kB view details)

Uploaded Aug 8, 2019 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

django_pwned_passwords-4.1.0-py2.py3-none-any.whl (7.6 kB view details)

Uploaded Aug 8, 2019 Python 2Python 3

File details

Details for the file django-pwned-passwords-4.1.0.tar.gz.

File metadata

Download URL: django-pwned-passwords-4.1.0.tar.gz
Upload date: Aug 8, 2019
Size: 7.0 kB
Tags: Source
Uploaded using Trusted Publishing? No
Uploaded via: Python-urllib/3.6

File hashes

Hashes for django-pwned-passwords-4.1.0.tar.gz
Algorithm	Hash digest
SHA256	`a75aa7b584dcfd7874c49deb2fd303cc2356f7bf39cf63cbb22b575b242c7a34`
MD5	`3ae30c57a13bdb62c04b91e16069da41`
BLAKE2b-256	`f952035938b4c793aded4dfcee816fb35b8d332d7efb5a593b5d98493a5ba5dd`

See more details on using hashes here.

File details

Details for the file django_pwned_passwords-4.1.0-py2.py3-none-any.whl.

File metadata

Download URL: django_pwned_passwords-4.1.0-py2.py3-none-any.whl
Upload date: Aug 8, 2019
Size: 7.6 kB
Tags: Python 2, Python 3
Uploaded using Trusted Publishing? No
Uploaded via: Python-urllib/3.6

File hashes

Hashes for django_pwned_passwords-4.1.0-py2.py3-none-any.whl
Algorithm	Hash digest
SHA256	`62f198ced2570ea4a21bb595ac6e46b8192b97a2064fbed95c9d550adf16dbaa`
MD5	`e884da7874ac4e00c3af98188be2db9d`
BLAKE2b-256	`0ac965cb61f64d822a638b0831bef4c20f411f3dce4864034e6dbddcce6c5731`