xpw
密码管理和身份验证
xpw-locker
访问认证：为 Web 页面接入身份验证
只需简单配置且无需改造任何既有代码，xpw-locker 可快速为任何 Web 页面启用身份验证。
xpw-locker 技术原理
xpw-locker 是一个轻量级的 Web 代理服务，它在用户通过身份验证后，将用户请求转发到目标服务器并返回响应。
xpw-locker 的工作流程如下：
- 首先检查用户的 session_id 是否在 cookies 中。
- 如果 session_id 不在 cookies 中，
xpw-locker会分配一个新的 session_id，并将其增加至用户的 cookies 中，然后xpw-locker向用户返回重定向请求以刷新页面。 - 如果 session_id 已在 cookies 中，
xpw-locker会检查 session_id 是否需要进行验证。 - 如果 session_id 无需登录，
xpw-locker会将用户用户请求转发到目标服务器并返回响应。 - 如果 session_id 需要登录，
xpw-locker会渲染登录页面并响应，用户输入用户名和密码后提交登录请求。 - 如果用户名和密码验证成功，
xpw-locker会将登记 session_id 信息，然后xpw-locker向用户返回重定向请求以刷新页面。 - 如果用户名和密码验证成功，
xpw-locker会再次渲染登录页面并响应。
sequenceDiagram
participant user as User
participant locker as xpw-locker
participant server as Web Server
autonumber
user->>+locker: GET
critical login_required
option session_id not in cookies
note right of locker: allocate session_id and set_cookie
note right of locker: redirect
option SESSIONS.verify(session_id)
critical proxy
locker->>+server: PROXY.request(request)
rect rgb(255, 0, 0)
break requests.ConnectionErroruser
note over locker,server: Response("Bad Gateway", status=502)
end
end
server->>-locker: Response
end
option session_id need login
note right of locker: render login.html
end
locker->>-user: Response
opt login
note right of user: input username and password
critical submit
user->>+locker: POST
critical login_required
option verify success
note right of locker: SESSIONS.sign_in(session_id)
note right of locker: redirect
option verify failure
note right of locker: render login.html
end
locker->>-user: Response
end
end
opt redirect
user->>+locker: GET
critical login_required
note right of locker: SESSIONS.verify(session_id)
critical proxy
locker->>+server: PROXY.request(request)
rect rgb(255, 0, 0)
break requests.ConnectionErroruser
note over locker,server: Response("Bad Gateway", status=502)
end
end
server->>-locker: Response
end
end
locker->>-user: Response
end
安装 xpw-locker
pip install --upgrade xpw
使用 xpw-locker
创建配置文件 xpwauth 并增加用户和密码：
[users]
demo = "demo"
xpw-locker --stdout --debug --target https://example.com/
1 maintainer
Metadata
1 maintainer
Release files for xpw 0.17
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| xpw-0.17.tar.gz | 23.0 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| xpw-0.17-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 54.5 kB
Release files / xpw-0.17.tar.gz
| Download URL | xpw-0.17.tar.gz |
|---|---|
| Size | 23.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
59a336f0e79f1399d24a3214b54834b4a264b43a1dfdbfde12948370671e4874
|
|
BLAKE2b-256 checksum How to use checksums |
367c8c168854e8a4fa72754b9ff87936bd8d9c76f3a6ea789fb9709cc4a47b8a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.3
|
Release files / xpw-0.17-py3-none-any.whl
| Download URL | xpw-0.17-py3-none-any.whl |
|---|---|
| Size | 31.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
a61dc97e5bd28c88aa7e7b7c23af89785365a9d14b87fe576711232d622ee692
|
|
BLAKE2b-256 checksum How to use checksums |
ca53d19dcb64e27db45624f685000b9dee110770bfb393b6cfb86592b358e010
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.3
|
Security for xpw 0.17
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
