This is a pre-production deployment of Warehouse. Changes made here affect the production instance of PyPI (pypi.python.org).
Help us improve Python packaging - Donate today!

Let the user secure his session for usage in public computers

Project Description

This app provides a mechanism to logout inactive authenticated users. An inactive browser should be logged out automatically if the user left his workstation, to protect sensitive data that may be displayed in the browser. It may be useful for CRMs, intranets, and such projects.

For example, if the user leaves for a coffee break, this app can force logout after say 5 minutes of inactivity.

Why not just set the session to expire after X minutes ?

Or “Why does this app even exist” ? Here are the reasons:

  • if the user session expires before the user is done reading a page: he will have to login again.
  • if the user session expires before the user is done filling a form: his work will be lost, and he will have to login again, and probably yell at you, dear django dev … at least I know I would !

This app allows to short circuit those limitations in session expiry.

How does it work ?

When the user loads a page, SessionSecurity middleware will set the last activity to now. The last activity is stored as datetime in request.session['_session_security']. To avoid having the middleware update that last activity datetime for a URL, add the url to settings.SESSION_SECURITY_PASSIVE_URLS.

When the user moves mouse, click, scroll or press a key, SessionSecurity will save the DateTime as a JavaScript attribute. It will send the number of seconds since when the last user activity was recorded to PingView, next time it should ping.

First, a warning should be shown after settings.SESSION_SECURITY_WARN_AFTER seconds. The warning displays a text like “Your session is about to expire, move the mouse to extend it”.

Before displaying this warning, SessionSecurity will upload the time since the last client-side activity was recorded. The middleware will take it if it is shorter than what it already has - ie. another more recent activity was detected in another browser tab. The PingView will respond with the number of seconds since the last activity - all browser tab included.

If there was no other, more recent, activity recorded by the server: it will show the warning. Otherwise it will update the last activity in javascript from the PingView response.

Same goes to expire after settings.SESSION_SECURITY_EXPIRE_AFTER seconds. Javascript will first make an ajax request to PingView to ensure that another more recent activity was not detected anywhere else - in any other browser tab.

Requirements

  • Python 2.7 or 3.5+
  • jQuery 1.7+
  • Django 1.8 to 2.0
  • django.contrib.staticfiles or #YoYo

Resources

You could subscribe to the mailing list ask questions or just be informed of package updates.

Release History

Release History

This version
History Node

2.5.1

History Node

2.5.0

History Node

2.4.1

History Node

2.4.0

History Node

2.3.2

History Node

2.3.1

History Node

2.3.0

History Node

2.2.4

History Node

2.2.3

History Node

2.2.2

History Node

2.2.1

History Node

2.2.0

History Node

2.1.7

History Node

2.1.6

History Node

2.1.5

History Node

2.1.2

History Node

2.1.1

History Node

2.1.0

History Node

2.0.6

History Node

2.0.5

History Node

2.0.4

History Node

2.0.3

History Node

2.0.2

History Node

2.0.0

History Node

1.2.2

History Node

1.2.1

History Node

1.1

History Node

1.0rc2

History Node

1.0rc1

Download Files

Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
django-session-security-2.5.1.tar.gz (97.6 kB) Copy SHA256 Checksum SHA256 Source Feb 7, 2017

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting