Skip to main content
This is a pre-production deployment of Warehouse. Changes made here affect the production instance of PyPI (pypi.python.org).
Help us improve Python packaging - Donate today!

Restrict Django sessions to IP and/or user agent.

Project Description

Restricts Django sessions to IP and/or user agent.

If the IP or user agent changes after creating the session, the a 400 response is given to the request, the session is flushed (all session data deleted, new session created) and a warning is logged. The goal of this middleware is to make it harder for an attacker to use a session ID they obtained. It does not make abuse of session IDs impossible.

For compatibility with IPv6 privacy extensions, by default only the first 64 bits of an IPv6 address are checked.

Documentation

The full documentation is at https://django-restricted-sessions.readthedocs.org.

Quickstart

Install django-restricted-sessions:

pip install django-restricted-sessions

Then add it to your middleware after SessionMiddleware:

MIDDLEWARE_CLASSES = [
    ....
    'django.contrib.sessions.middleware.SessionMiddleware',
    # 'django.contrib.auth.middleware.AuthenticationMiddleware',
    'restrictedsessions.middleware.RestrictedSessionsMiddleware',
    ....
]

When RESTRICTEDSESSIONS_AUTHED_ONLY setting enabled ensure this middleware is added after AuthenticationMiddleware such that the request.user is present.

History

0.2.0 (2017-04-06)

  • For Django 1.10+ support, changed from object to django.utils.deprecation.MiddlewareMixin
  • Added PyPI trove classifiers for Django versions and more Python versions
  • Updated travis.yml for more Python versions

0.1.4 (2016-07-02)

  • Fixed an exception that could occur when non-utf8 bytes were included in user agent strings.

0.1.3.1 (2016-05-26)

  • Version bump to avoid PyPI’s duplicate filename ban.

0.1.3 (2016-05-26)

  • Added support to redirect to known view, or use custom status code settings.
  • Added support for ignoring unauthenticated sessions.
  • Fixed short circuit when REMOTE_ADDR was unknown.
  • Dropped support for older Python versions: now requires 2.7, 3.3 or newer, with Django 1.8.

0.1.2 (2014-03-20)

  • Resolved exception being raised when session switches from IPv4 to IPv6
  • Python 3.4 support

0.1.1 (2014-02-18)

  • Added missing netaddr requirement to setup.py.

0.1.0 (2014-02-17)

  • First release on PyPI.
Release History

Release History

This version
History Node

0.2.0

History Node

0.1.4

History Node

0.1.3.1

History Node

0.1.2

History Node

0.1.1

History Node

0.1.0

Download Files

Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
django-restricted-sessions-0.2.0.tar.gz (6.7 kB) Copy SHA256 Checksum SHA256 Source Apr 6, 2017

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting