django-device-cookies 0.1.0__tar.gz

django_device_cookies-0.1.0/.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{css,html,js,yaml,yml}]
+indent_size = 2

django_device_cookies-0.1.0/.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      github-actions:
+        patterns: ["*"]
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"

django_device_cookies-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,101 @@
+name: CI
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: ["main"]
+  push:
+    branches: ["main"]
+  release:
+    types:
+      - published
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Run prek
+        uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        django-version: ["5.2", "6.0", "6.1"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        exclude:
+          - django-version: "6.0"
+            python-version: "3.10"
+          - django-version: "6.0"
+            python-version: "3.11"
+          - django-version: "6.1"
+            python-version: "3.10"
+          - django-version: "6.1"
+            python-version: "3.11"
+    steps:
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Check out code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          cache-dependency-glob: uv.lock
+          enable-cache: true
+      - name: Install dependencies
+        run: |
+          uv sync --frozen --python ${{ matrix.python-version }}
+          uv pip install --python .venv django~=${{ matrix.django-version }}.0
+      - name: Run tests
+        run: |
+          uv run --no-sync python -m coverage run -m pytest
+          uv run --no-sync python -m coverage xml
+      - name: Check coverage
+        run: uv run --no-sync python -m coverage report --fail-under=100
+      - name: Upload coverage
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: coverage.xml
+          fail_ci_if_error: true
+
+  checks:
+    if: always()
+    runs-on: ubuntu-latest
+    needs: [lint, test]
+    steps:
+      - name: Check all jobs passed
+        run: |
+          [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "false" ]
+
+  release:
+    if: ${{ github.event_name == 'release' }}
+    runs-on: ubuntu-latest
+    needs: [checks]
+    environment:
+      name: pypi
+      url: https://pypi.org/p/django-device-cookies
+    permissions:
+      id-token: write
+    steps:
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.14"
+      - name: Check out code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          enable-cache: false
+      - name: Build package
+        run: uv build
+      - name: Publish package
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1

django_device_cookies-0.1.0/.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,33 @@
+name: Dependabot auto-merge
+
+on: pull_request
+
+permissions: {}
+
+jobs:
+  auto-merge:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
+      - name: Enable auto-merge
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          gh pr merge --squash --auto "$PR_URL" ||
+            gh pr merge --squash "$PR_URL" ||
+            echo "::warning::Could not enable auto-merge or merge directly"
+      - name: Approve
+        if: >-
+          contains(fromJSON('["github_actions", "github-actions"]'), steps.metadata.outputs.package-ecosystem)
+          || steps.metadata.outputs.update-type != 'version-update:semver-major'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: gh pr review --approve "$PR_URL"

django_device_cookies-0.1.0/.github/workflows/update-hooks.yml

@@ -0,0 +1,78 @@
+name: Update hooks
+
+on:
+  schedule:
+    - cron: "17 5 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Check out code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Install prek
+        uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
+        with:
+          install-only: true
+      - name: Update hook versions
+        run: prek update
+      - name: Run hooks
+        run: prek run --all-files || prek run --all-files || true
+      - name: Check which files changed
+        id: changes
+        run: |
+          if [ "$(git status --porcelain)" = " M .pre-commit-config.yaml" ]; then
+            echo "config-only=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "config-only=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Create pull request
+        id: pr
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
+        with:
+          commit-message: Update pre-commit hooks
+          title: Update pre-commit hooks
+          body: Automated hook update from the `update-hooks` workflow, using `prek update`.
+          branch: update-pre-commit-hooks
+          delete-branch: true
+      - name: Approve CI run
+        if: steps.pr.outputs.pull-request-operation == 'created' || steps.pr.outputs.pull-request-operation == 'updated'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PAT: ${{ secrets.AUTOMATION_TOKEN }}
+        run: |
+          for i in $(seq 1 24); do
+            run_ids=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs?branch=update-pre-commit-hooks&event=pull_request" \
+              --jq '.workflow_runs[] | select(.conclusion == "action_required") | .id')
+            [ -n "$run_ids" ] && break
+            sleep 5
+          done
+          if [ -z "$run_ids" ]; then
+            echo "No CI run waiting for approval"
+            exit 0
+          fi
+          for run_id in $run_ids; do
+            gh api -X POST "repos/$GITHUB_REPOSITORY/actions/runs/$run_id/approve" ||
+              GH_TOKEN="$PAT" gh api -X POST "repos/$GITHUB_REPOSITORY/actions/runs/$run_id/approve"
+          done
+      - name: Enable auto-merge
+        if: steps.pr.outputs.pull-request-operation == 'created' || steps.pr.outputs.pull-request-operation == 'updated'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ steps.pr.outputs.pull-request-number }}
+        run: |
+          gh pr merge --squash --auto "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" ||
+            echo "::warning::Could not enable auto-merge"
+      - name: Approve if only the hook config changed
+        if: steps.changes.outputs.config-only == 'true' && (steps.pr.outputs.pull-request-operation == 'created' || steps.pr.outputs.pull-request-operation == 'updated')
+        env:
+          GH_TOKEN: ${{ secrets.AUTOMATION_TOKEN }}
+          PR_NUMBER: ${{ steps.pr.outputs.pull-request-number }}
+        run: gh pr review --approve "$PR_NUMBER" --repo "$GITHUB_REPOSITORY"

django_device_cookies-0.1.0/.gitignore

@@ -0,0 +1,4 @@
+__pycache__/
+.coverage
+coverage.xml
+dist/

django_device_cookies-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,22 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: check-added-large-files
+      - id: check-merge-conflict
+      - id: check-toml
+      - id: check-yaml
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+
+  - repo: https://github.com/rstcheck/rstcheck
+    rev: v6.3.0
+    hooks:
+      - id: rstcheck
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.16.8
+    hooks:
+      - id: ruff
+        args: [--fix]
+      - id: ruff-format

django_device_cookies-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Tom Carrick
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

django_device_cookies-0.1.0/PKG-INFO

@@ -0,0 +1,176 @@
+Metadata-Version: 2.5
+Name: django-device-cookies
+Version: 0.1.0
+Summary: Login throttling with device cookies
+Project-URL: Homepage, https://github.com/knyghty/django-device-cookies
+Project-URL: Repository, https://github.com/knyghty/django-device-cookies
+Author-email: Tom Carrick <tom@carrick.eu>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Web Environment
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 5.2
+Classifier: Framework :: Django :: 6.0
+Classifier: Framework :: Django :: 6.1
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Requires-Dist: django>=5.2
+Description-Content-Type: text/x-rst
+
+=====================
+Django Device Cookies
+=====================
+
+Throttle login attempts with `device cookies`_. Each login sets a signed
+cookie, and failed attempts count per cookie, or per username for requests
+without a valid one.
+
+Why
+---
+
+Temporary account lockout after several failed attempts is an easy target for
+denial of service: a fixed lockout policy lets an attacker lock selected users
+out of the site. Locking the account/IP pair instead is better against denial
+of service but weaker against botnets and proxies, and harder to implement
+correctly. Device cookies are a variant of account/IP blocking that uses a
+browser cookie instead of an IP address. The throttle trusts a client that
+logged in before and locks it out individually. All untrusted clients share
+one temporary lockout per account. That bounds the guesses against an account
+to ``DEVICE_COOKIE_ATTEMPTS_PER_PERIOD`` per ``DEVICE_COOKIE_PERIOD``
+regardless of the size of the botnet.
+
+Installation
+------------
+
+1. Add ``"django_device_cookies"`` to ``INSTALLED_APPS``.
+2. Add ``"django_device_cookies.middleware.DeviceCookieMiddleware"`` to
+   ``MIDDLEWARE``.
+3. Put ``"django_device_cookies.backends.DeviceCookieBackend"`` first in
+   ``AUTHENTICATION_BACKENDS``, before ``ModelBackend`` or your own backends.
+4. Run ``manage.py migrate``.
+
+With two backends, a call to ``login()`` for a user that did not come from
+``authenticate()`` must pass ``backend``, as the Django documentation says.
+
+``django_device_cookies.backends.DeviceCookieModelBackend`` is ``ModelBackend``
+with the throttle built in, for projects that want a single entry. Django
+stores the path of the backend that authenticated a user in the session.
+Replacing ``ModelBackend`` with it logs out every existing session.
+
+Settings
+--------
+
+The defaults:
+
+.. code-block:: python
+
+    DEVICE_COOKIE_NAME = "django_device"
+    DEVICE_COOKIE_PERIOD = timedelta(minutes=15)
+    DEVICE_COOKIE_ATTEMPTS_PER_PERIOD = 5
+    DEVICE_COOKIE_MAX_AGE = timedelta(days=365)
+    DEVICE_COOKIE_SECURE = True
+    DEVICE_COOKIE_SAMESITE = "Lax"
+    DEVICE_COOKIE_DOMAIN = None
+    DEVICE_COOKIE_PATH = "/"
+    DEVICE_COOKIE_PER_USER = False
+    DEVICE_COOKIE_REVOKE_AFTER_FAILURES = None
+
+``DEVICE_COOKIE_PER_USER`` sets one cookie per user instead of per browser.
+``DEVICE_COOKIE_REVOKE_AFTER_FAILURES`` stops trusting a cookie after that many
+failures over its life.
+
+Password reset
+--------------
+
+An attacker can keep the untrusted lockout for an account in place, which
+blocks its user from logging in from a new device. OWASP suggests issuing a
+device cookie when the user visits a password reset link, since that proves
+possession of the email account. An actual password reset is not necessary.
+``django_device_cookies.views.PasswordResetConfirmView`` does this. Add it to
+your URLs before ``include("django.contrib.auth.urls")``:
+
+.. code-block:: python
+
+    from django_device_cookies.views import PasswordResetConfirmView
+
+    path(
+        "accounts/reset/<uidb64>/<token>/",
+        PasswordResetConfirmView.as_view(),
+        name="password_reset_confirm",
+    ),
+
+It renders ``registration/password_reset_confirm.html``, like Django's view.
+
+Signals
+-------
+
+``django_device_cookies.signals.lockout``
+    Sent when an account or a device reaches the failed attempt limit.
+
+    Arguments sent with this signal:
+
+    ``sender``
+        The ``FailedAuthenticationAttempt`` class.
+
+    ``username``
+        The normalized username.
+
+    ``device``
+        The device cookie nonce, or ``""`` for untrusted clients.
+
+    ``request``
+        The current ``HttpRequest``, or ``None``.
+
+Maintenance
+-----------
+
+Nothing removes expired failed attempts automatically. The
+``clear_device_cookie_attempts`` management command deletes them. Run it on a
+regular basis, for example as a daily cron job.
+
+Limitations
+-----------
+
+- The throttle covers only calls to ``authenticate()`` and
+  ``aauthenticate()``. Calls without a request count as untrusted.
+- Attempts sent in parallel can exceed the limit.
+- If Django masks your ``USERNAME_FIELD`` in the ``user_login_failed`` signal,
+  the throttle ignores calls without a request that pass it by name.
+
+System checks
+-------------
+
+* **device_cookies.E001**: ``AUTHENTICATION_BACKENDS`` has no device cookie
+  backend. Nothing throttles logins.
+* **device_cookies.W001**: The device cookie backend is not first in
+  ``AUTHENTICATION_BACKENDS``. A locked-out client that knows the password
+  still logs in.
+* **device_cookies.E002**: ``MIDDLEWARE`` has no device cookie middleware. No
+  client gets a device cookie, and every login attempt counts as untrusted.
+* **device_cookies.E003**: ``<setting>`` must be ``<expected>``.
+* **device_cookies.E004**: Browsers reject a ``SameSite=None`` cookie that is
+  not ``Secure``. No client gets a device cookie.
+* **device_cookies.E005**: ``AUTHENTICATION_BACKENDS`` has only the device
+  cookie backend. Nothing authenticates.
+* **device_cookies.W003**: Django masks ``USERNAME_FIELD`` ``<field>`` in the
+  ``user_login_failed`` signal. The throttle ignores calls to
+  ``authenticate()`` without a request that pass it by name.
+
+This check runs only with the ``--deploy`` option:
+
+* **device_cookies.W002**: ``DEVICE_COOKIE_SECURE`` is off. Browsers send
+  device cookies over HTTP.
+
+.. _`device cookies`: https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies

django_device_cookies-0.1.0/README.rst

@@ -0,0 +1,145 @@
+=====================
+Django Device Cookies
+=====================
+
+Throttle login attempts with `device cookies`_. Each login sets a signed
+cookie, and failed attempts count per cookie, or per username for requests
+without a valid one.
+
+Why
+---
+
+Temporary account lockout after several failed attempts is an easy target for
+denial of service: a fixed lockout policy lets an attacker lock selected users
+out of the site. Locking the account/IP pair instead is better against denial
+of service but weaker against botnets and proxies, and harder to implement
+correctly. Device cookies are a variant of account/IP blocking that uses a
+browser cookie instead of an IP address. The throttle trusts a client that
+logged in before and locks it out individually. All untrusted clients share
+one temporary lockout per account. That bounds the guesses against an account
+to ``DEVICE_COOKIE_ATTEMPTS_PER_PERIOD`` per ``DEVICE_COOKIE_PERIOD``
+regardless of the size of the botnet.
+
+Installation
+------------
+
+1. Add ``"django_device_cookies"`` to ``INSTALLED_APPS``.
+2. Add ``"django_device_cookies.middleware.DeviceCookieMiddleware"`` to
+   ``MIDDLEWARE``.
+3. Put ``"django_device_cookies.backends.DeviceCookieBackend"`` first in
+   ``AUTHENTICATION_BACKENDS``, before ``ModelBackend`` or your own backends.
+4. Run ``manage.py migrate``.
+
+With two backends, a call to ``login()`` for a user that did not come from
+``authenticate()`` must pass ``backend``, as the Django documentation says.
+
+``django_device_cookies.backends.DeviceCookieModelBackend`` is ``ModelBackend``
+with the throttle built in, for projects that want a single entry. Django
+stores the path of the backend that authenticated a user in the session.
+Replacing ``ModelBackend`` with it logs out every existing session.
+
+Settings
+--------
+
+The defaults:
+
+.. code-block:: python
+
+    DEVICE_COOKIE_NAME = "django_device"
+    DEVICE_COOKIE_PERIOD = timedelta(minutes=15)
+    DEVICE_COOKIE_ATTEMPTS_PER_PERIOD = 5
+    DEVICE_COOKIE_MAX_AGE = timedelta(days=365)
+    DEVICE_COOKIE_SECURE = True
+    DEVICE_COOKIE_SAMESITE = "Lax"
+    DEVICE_COOKIE_DOMAIN = None
+    DEVICE_COOKIE_PATH = "/"
+    DEVICE_COOKIE_PER_USER = False
+    DEVICE_COOKIE_REVOKE_AFTER_FAILURES = None
+
+``DEVICE_COOKIE_PER_USER`` sets one cookie per user instead of per browser.
+``DEVICE_COOKIE_REVOKE_AFTER_FAILURES`` stops trusting a cookie after that many
+failures over its life.
+
+Password reset
+--------------
+
+An attacker can keep the untrusted lockout for an account in place, which
+blocks its user from logging in from a new device. OWASP suggests issuing a
+device cookie when the user visits a password reset link, since that proves
+possession of the email account. An actual password reset is not necessary.
+``django_device_cookies.views.PasswordResetConfirmView`` does this. Add it to
+your URLs before ``include("django.contrib.auth.urls")``:
+
+.. code-block:: python
+
+    from django_device_cookies.views import PasswordResetConfirmView
+
+    path(
+        "accounts/reset/<uidb64>/<token>/",
+        PasswordResetConfirmView.as_view(),
+        name="password_reset_confirm",
+    ),
+
+It renders ``registration/password_reset_confirm.html``, like Django's view.
+
+Signals
+-------
+
+``django_device_cookies.signals.lockout``
+    Sent when an account or a device reaches the failed attempt limit.
+
+    Arguments sent with this signal:
+
+    ``sender``
+        The ``FailedAuthenticationAttempt`` class.
+
+    ``username``
+        The normalized username.
+
+    ``device``
+        The device cookie nonce, or ``""`` for untrusted clients.
+
+    ``request``
+        The current ``HttpRequest``, or ``None``.
+
+Maintenance
+-----------
+
+Nothing removes expired failed attempts automatically. The
+``clear_device_cookie_attempts`` management command deletes them. Run it on a
+regular basis, for example as a daily cron job.
+
+Limitations
+-----------
+
+- The throttle covers only calls to ``authenticate()`` and
+  ``aauthenticate()``. Calls without a request count as untrusted.
+- Attempts sent in parallel can exceed the limit.
+- If Django masks your ``USERNAME_FIELD`` in the ``user_login_failed`` signal,
+  the throttle ignores calls without a request that pass it by name.
+
+System checks
+-------------
+
+* **device_cookies.E001**: ``AUTHENTICATION_BACKENDS`` has no device cookie
+  backend. Nothing throttles logins.
+* **device_cookies.W001**: The device cookie backend is not first in
+  ``AUTHENTICATION_BACKENDS``. A locked-out client that knows the password
+  still logs in.
+* **device_cookies.E002**: ``MIDDLEWARE`` has no device cookie middleware. No
+  client gets a device cookie, and every login attempt counts as untrusted.
+* **device_cookies.E003**: ``<setting>`` must be ``<expected>``.
+* **device_cookies.E004**: Browsers reject a ``SameSite=None`` cookie that is
+  not ``Secure``. No client gets a device cookie.
+* **device_cookies.E005**: ``AUTHENTICATION_BACKENDS`` has only the device
+  cookie backend. Nothing authenticates.
+* **device_cookies.W003**: Django masks ``USERNAME_FIELD`` ``<field>`` in the
+  ``user_login_failed`` signal. The throttle ignores calls to
+  ``authenticate()`` without a request that pass it by name.
+
+This check runs only with the ``--deploy`` option:
+
+* **device_cookies.W002**: ``DEVICE_COOKIE_SECURE`` is off. Browsers send
+  device cookies over HTTP.
+
+.. _`device cookies`: https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies

django_device_cookies-0.1.0/codecov.yml

@@ -0,0 +1,8 @@
+coverage:
+  status:
+    project:
+      default:
+        target: 100%
+    patch:
+      default:
+        target: 100%

django_device_cookies-0.1.0/django_device_cookies/admin.py

@@ -0,0 +1,30 @@
+from django.contrib import admin
+from django.contrib.auth import get_user_model
+from django.db.models import Q
+from django.db.models import QuerySet
+from django.http import HttpRequest
+
+from . import utils
+from .models import FailedAuthenticationAttempt
+from .models import hash_username
+
+
+@admin.register(FailedAuthenticationAttempt)
+class FailedAuthenticationAttemptAdmin(admin.ModelAdmin):
+    list_display = ["key", "device", "time"]
+    ordering = ["-time"]
+    search_fields = ["key"]
+
+    @property
+    def search_help_text(self) -> str:
+        user_model = get_user_model()
+        field = user_model._meta.get_field(user_model.USERNAME_FIELD)
+        return f"Enter the {field.verbose_name} or a key."
+
+    def get_search_results(
+        self, request: HttpRequest, queryset: QuerySet, search_term: str
+    ) -> tuple[QuerySet, bool]:
+        if search_term:
+            key = hash_username(utils.normalize_username(search_term))
+            queryset = queryset.filter(Q(key=key) | Q(key=search_term))
+        return queryset, False

django_device_cookies-0.1.0/django_device_cookies/apps.py

@@ -0,0 +1,11 @@
+from django.apps import AppConfig
+
+
+class DeviceCookiesConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "django_device_cookies"
+    label = "device_cookies"
+
+    def ready(self) -> None:
+        from . import checks  # noqa: F401
+        from . import receivers  # noqa: F401