Restricts Django sessions to IP and/or user agent.
If the IP or user agent changes after creating the session, the a 400 response is given to the request, the session is flushed (all session data deleted, new session created) and a warning is logged. The goal of this middleware is to make it harder for an attacker to use a session ID they obtained. It does not make abuse of session IDs impossible.
For compatibility with IPv6 privacy extensions, by default only the first 64 bits of an IPv6 address are checked.
Documentation
The full documentation is at https://django-restricted-sessions.readthedocs.org.
Quickstart
Install django-restricted-sessions:
pip install django-restricted-sessions
Then add it to your middleware after SessionMiddleware:
MIDDLEWARE_CLASSES = [
....
'django.contrib.sessions.middleware.SessionMiddleware',
# 'django.contrib.auth.middleware.AuthenticationMiddleware',
'restrictedsessions.middleware.RestrictedSessionsMiddleware',
....
]
When RESTRICTEDSESSIONS_AUTHED_ONLY setting enabled ensure this middleware is added after AuthenticationMiddleware such that the request.user is present.
History
0.3.0 (2019-12-03)
Updated Django support to 1.11, 2.2 and 3.0.
Fixed issues when X_FORWARDED_FOR contains multiple addresses.
0.2.0 (2017-04-06)
For Django 1.10+ support, changed from object to django.utils.deprecation.MiddlewareMixin
Added PyPI trove classifiers for Django versions and more Python versions
Updated travis.yml for more Python versions
0.1.4 (2016-07-02)
Fixed an exception that could occur when non-utf8 bytes were included in user agent strings.
0.1.3.1 (2016-05-26)
Version bump to avoid PyPI’s duplicate filename ban.
0.1.3 (2016-05-26)
Added support to redirect to known view, or use custom status code settings.
Added support for ignoring unauthenticated sessions.
Fixed short circuit when REMOTE_ADDR was unknown.
Dropped support for older Python versions: now requires 2.7, 3.3 or newer, with Django 1.8.
0.1.2 (2014-03-20)
Resolved exception being raised when session switches from IPv4 to IPv6
Python 3.4 support
0.1.1 (2014-02-18)
Added missing netaddr requirement to setup.py.
0.1.0 (2014-02-17)
First release on PyPI.
1 maintainer
Metadata
1 maintainer
Release files for django-restricted-sessions 0.3.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| django-restricted-sessions-0.3.0.tar.gz | 6.8 kB | Without provenance | Details for django-restricted-sessions-0.3.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| django_restricted_sessions-0.3.0-py2.py3-none-any.whl | Python 2, Python 3 | none | any | Details for django_restricted_sessions-0.3.0-py2.py3-none-any.whl |
Total release size: 11.3 kB
Release files / django-restricted-sessions-0.3.0.tar.gz
| Download URL | django-restricted-sessions-0.3.0.tar.gz |
|---|---|
| Size | 6.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
3e521a109247a655b138a98a458984692fb3ac050e25d9193ff97df77b3bf84b
|
|
BLAKE2b-256 checksum How to use checksums |
6ae7fdc774afc30409be2127b41e0c1bdc75dca3dfb962830eb7a06a1c41daac
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.1.1 pkginfo/1.5.0.1 requests/2.22.0 setuptools/40.8.0 requests-toolbelt/0.9.1 tqdm/4.40.0 CPython/3.7.3
|
Release files / django_restricted_sessions-0.3.0-py2.py3-none-any.whl
| Download URL | django_restricted_sessions-0.3.0-py2.py3-none-any.whl |
|---|---|
| Size | 4.5 kB |
| Tags | Python 2 Python 3 |
|
SHA-256 checksum How to use checksums |
e5ec40230c135b2e7c4ec71dcc14dcaf100bd3a95910af0ad39411a9d87c79a5
|
|
BLAKE2b-256 checksum How to use checksums |
8cb7e1440cf02e45b58cf4323e430372724021ed3bde780475f2bca5e3bb86ea
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.1.1 pkginfo/1.5.0.1 requests/2.22.0 setuptools/40.8.0 requests-toolbelt/0.9.1 tqdm/4.40.0 CPython/3.7.3
|
Security for django-restricted-sessions 0.3.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
