Skip to main content

Encrypts information in urls, such as login credentials. Useful if you want to send a user a link that logs the user in without leaking their login credentials.

Project description

django-urlcrypt encrypts information in urls, such as login credentials.

For example, assume I have url patterns that looks like this:

urlpatterns = patterns('',
    url(r'^inbox/$', 'message_inbox', name='message_inbox'),
    (r'^r/', include('urlcrypt.urls')),
)

I can use django-urlcrypt to generate a url for a user that looks like:

http://www.mydomain.com/r/TkNJBkNFAghDWkdFGPUAQEfcDUJfEBIREgEUFl1BQ18IQkdDUUcPSh4ADAYAWhYKHh8KHBsHEw

and will automatically log that person in and redirects them to /inbox/.

Installation

  1. easy_install django-urlcrypt or pip install django-urlcrypt

  2. Add urlcrypt to your INSTALLED_APPS

  3. In settings.py add 'urlcrypt.auth_backends.UrlCryptBackend' to AUTHENTICATION_BACKENDS

  4. In urls.py add:

    (r'^r/', include('urlcrypt.urls')),
  5. (recommended) If you wish to use RSA encryption on your tokens, generate a private key with ssh-keygen -t rsa -f <path to private key> if you don’t already have one, and then set the path to the private key as URLCRYPT_PRIVATE_KEY_PATH. RSA encryption makes the token much longer but is more secure. The pycrypto library is required.

Usage

In a view:

from django.core.urlresolvers import reverse
from urlcrypt import lib as urlcrypt

token = urlcrypt.generate_login_token(user, reverse('message_inbox'))
encoded_url = reverse('urlcrypt_redirect', args=(token,))
# yours will look slightly different because you have a different SECRET_KEY, but approximately
# encoded_url == /r/TkNJBkNFAghDWkdFGPUAQEfcDUJfEBIREgEUFl1BQ18IQkdDUUcPSh4ADAYAWhYKHh8KHBsHEw

In a template:

{% load urlcrypt_tags %}
<a href="{% encoded_url user message_inbox %}">click me to log in as {{user.username}} and go to {% url message_inbox %}</a>

Advanced lib usage:

from urlcrypt import lib as urlcrypt

message = {
    'url': u'/users/following/',
    'user_id': '12345'
}

token = urlcrypt.encode_token((message['user_id'], message['url']))
decoded_message = urlcrypt.decode_token(token, ('user_id', 'url', 'timestamp'))

>>> print token
TkNJBkNFAghDWkdFGPUAQEfcDUJfEBIREgEUFl1BQ18IQkdDUUcPSh4ADAYAWhYKHh8KHBsHEw

>>> print decoded_message
{'url': '/users/following/', 'user_id': '12345'}

Settings

  • URLCRYPT_LOGIN_URL

    • default: LOGIN_URL

    • If urlcrypt authentication fails, redirects to URLCRYPT_LOGIN_URL.

  • URLCRYPT_RATE_LIMIT

    • default: 60

    • The number of urlcrypt requests a unique visitor is allowed to make per minute.

  • URLCRYPT_PRIVATE_KEY_PATH

    • default: None

    • The path to the RSA private key file in PEM format. If None, RSA encryption will not be used.

  • RUNNING_TESTS

    • default: False

    • Set RUNNING_TESTS to True when running the urlcrypt tests.

Credits

David Ziegler

Christopher Hesse

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

django-urlcrypt-0.1.6.tar.gz (12.9 kB view details)

Uploaded Source

File details

Details for the file django-urlcrypt-0.1.6.tar.gz.

File metadata

File hashes

Hashes for django-urlcrypt-0.1.6.tar.gz
Algorithm Hash digest
SHA256 cf232646fb13fd68efddede424754d697c716d02d3e2e9d3ef31e48200c9acf2
MD5 e4eb9121a22b4ae420bffec802f82ebe
BLAKE2b-256 54096b8a2b8265e6dd5fcfe1b283ae7725f994858280e2538b27150f0757eb2a

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page