Skip to main content

JavaScript Challenge-handshake authentication django app

Project description

JavaScript Challenge-handshake authentication django app.

Build Status on

Coverage Status on

First: The Secure-JS-Login is not a simple “send username + PBKDF2-SHA(password)” It is more a Challenge-handshake authentication protocol!


  • fix “next_url” and all links in example project

The procedure:

Save a new user password:

client browser / JavaScript part:

#. user input a password
  1. init_pbkdf2_salt = SHA1(random data)

  2. pbkdf2_hash = pbkdf2("Plain Password", salt=init_pbkdf2_salt)

  3. Client send init_pbkdf2_salt and pbkdf2_hash to the server

Server part:

  1. Server split pbkdf2_hash into: first_pbkdf2_part and second_pbkdf2_part

  2. encrypted_part = xor_encrypt(first_pbkdf2_part, key=second_pbkdf2_part)

  3. Save only encrypted_part and given init_pbkdf2_salt from client

Login - client browser / JavaScript part:

  1. Use request login

  2. server send html login form with a random server_challenge value

  3. User enters his username and password

  4. Ajax Request the init_pbkdf2_salt from server with the given username

  5. generate the auth data:

    1. pbkdf2_temp_hash = pbkdf2("Plain Password", init_pbkdf2_salt)

    2. split pbkdf2_temp_hash into first_pbkdf2_part and second_pbkdf2_part

    3. cnonce = SHA1(random data)

    4. pbkdf2_hash = pbkdf2(first_pbkdf2_part, salt=cnonce + server_challenge)

  6. send pbkdf2_hash, second_pbkdf2_part and cnonce to the server

validation on the server

  1. client POST data: pbkdf2_hash, second_pbkdf2_part and cnonce

  2. get transmitted server_challenge value from session

  3. get encrypted_part and salt from database via given username

  4. first_pbkdf2_part = xor_decrypt(encrypted_part, key=second_pbkdf2_part)

  5. test_hash = pbkdf2(first_pbkdf2_part, key=cnonce + server_challenge)

  6. compare test_hash with transmitted pbkdf2_hash


Secure-JS-Login is not really secure in comparison to https! e.g. the client can’t validate if he really communicate with the server or with a Man-in-the-middle attack.

However the used procedure is safer than plain-text authentication. In addition, on the server no plain-text passwords are stored. With the data that are stored on the server, can not be used alone.

If you have https, you can combine it with Secure-JS-Login, similar to combine a digest auth with https.

More information: Warum Secure-JS-Login Sinn macht… (german only, sorry)


Many, if not even all CMS/wiki/forum, used unsecure Login. User name and password send in plaintext over the Internet. A reliable solution offers only https.

The Problem: No Provider offers secured HTTP connection for little money :(

alternative solutions

  • Digest access authentication (implementation in django exist: django-digest):

    • pro

      • Browser implemented it, so no additional JavaScript needed

    • cons

      • Password hash must be saved on the server, without any salt! The hash can be used for login, because: hash = MD5(username:realm:password)

      • used old MD5 hash



~ $ virtualenv secure-js-login-env
~ $ cd secure-js-login-env
~/secure-js-login-env $ source bin/activate

# install secure-js-login as "editable" to have access to example project server and unittests:

(secure-js-login-env)~/secure-js-login-env $ pip install -e git+git://

run example project server:
(secure-js-login-env)~/secure-js-login-env $ cd src/django-secure-js-login/
(secure-js-login-env)~/secure-js-login-env/src/django-secure-js-login $ ./

run inittests:

(secure-js-login-env)~/secure-js-login-env/src/django-secure-js-login $ ./

to run the Live-Server-Tests, install selenium e.g.:

(secure-js-login-env)~/secure-js-login-env/src/django-secure-js-login $ pip install selenium
(secure-js-login-env)~/secure-js-login-env/src/django-secure-js-login $ ./

Version compatibility





v1.7, v1.8

v2.7, v3.4

(These are the unittests variants. Maybe other versions are compatible, too.)


Used JavaScript Implementations


Come into the conversation, besides the github communication features:


#pylucid on (Yes, the PyLucid channel…)


Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

django-secure-js-login-0.2.0.tar.gz (43.2 kB view hashes)

Uploaded source

Built Distribution

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Huawei Huawei PSF Sponsor Microsoft Microsoft PSF Sponsor NVIDIA NVIDIA PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page