django-session-security-continued 3.0.0a1__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- django_session_security_continued-3.0.0a1/LICENSE +22 -0
- django_session_security_continued-3.0.0a1/PKG-INFO +209 -0
- django_session_security_continued-3.0.0a1/README.md +179 -0
- django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/PKG-INFO +209 -0
- django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/SOURCES.txt +48 -0
- django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/dependency_links.txt +1 -0
- django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/requires.txt +1 -0
- django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/top_level.txt +1 -0
- django_session_security_continued-3.0.0a1/pyproject.toml +221 -0
- django_session_security_continued-3.0.0a1/session_security/__init__.py +0 -0
- django_session_security_continued-3.0.0a1/session_security/middleware.py +119 -0
- django_session_security_continued-3.0.0a1/session_security/models.py +0 -0
- django_session_security_continued-3.0.0a1/session_security/settings.py +53 -0
- django_session_security_continued-3.0.0a1/session_security/templatetags/__init__.py +0 -0
- django_session_security_continued-3.0.0a1/session_security/templatetags/session_security_tags.py +29 -0
- django_session_security_continued-3.0.0a1/session_security/tests/__init__.py +0 -0
- django_session_security_continued-3.0.0a1/session_security/tests/conftest.py +149 -0
- django_session_security_continued-3.0.0a1/session_security/tests/project/__init__.py +0 -0
- django_session_security_continued-3.0.0a1/session_security/tests/project/settings.py +112 -0
- django_session_security_continued-3.0.0a1/session_security/tests/project/urls.py +33 -0
- django_session_security_continued-3.0.0a1/session_security/tests/project/wsgi.py +20 -0
- django_session_security_continued-3.0.0a1/session_security/tests/test_base.py +50 -0
- django_session_security_continued-3.0.0a1/session_security/tests/test_middleware.py +87 -0
- django_session_security_continued-3.0.0a1/session_security/tests/test_script.py +77 -0
- django_session_security_continued-3.0.0a1/session_security/tests/test_templates.py +17 -0
- django_session_security_continued-3.0.0a1/session_security/tests/test_views.py +43 -0
- django_session_security_continued-3.0.0a1/session_security/urls.py +29 -0
- django_session_security_continued-3.0.0a1/session_security/utils.py +14 -0
- django_session_security_continued-3.0.0a1/session_security/views.py +29 -0
- django_session_security_continued-3.0.0a1/setup.cfg +4 -0
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2018 YourLabs
|
|
4
|
+
Copyright (c) 2025 Arrai Innovations Inc.
|
|
5
|
+
|
|
6
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
7
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
8
|
+
in the Software without restriction, including without limitation the rights
|
|
9
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
10
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
11
|
+
furnished to do so, subject to the following conditions:
|
|
12
|
+
|
|
13
|
+
The above copyright notice and this permission notice shall be included in all
|
|
14
|
+
copies or substantial portions of the Software.
|
|
15
|
+
|
|
16
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
17
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
18
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
19
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
20
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
21
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
22
|
+
SOFTWARE.
|
|
@@ -0,0 +1,209 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: django-session-security-continued
|
|
3
|
+
Version: 3.0.0a1
|
|
4
|
+
Summary: Client and server-side session timeout enforcement with warnings for Django 4.2+.
|
|
5
|
+
Author: Matt Bosworth (https://github.com/mattbo), Fabio Caritas Barrionuevo da Luz (https://github.com/luzfcb), Pēteris Caune (https://github.com/cuu508), John David Giese (https://github.com/johndgiese), Jose Antonio Martin Prieto (https://github.com/jantoniomartin), Richard Moorhead (https://github.com/autodidacticon), Jean-Michel Nirgal Vourgère (https://github.com/nirgal), Michał Pasternak (https://github.com/mpasternak), James Pic (https://github.com/jpic), Matthew Schettler (https://github.com/mschettler), Scott Sexton (https://github.com/scottsexton), Jacek Ostański (https://github.com/jacoor), Aaron Krill (https://github.com/krillr), @yscumc (https://github.com/yscumc), Marco Fucci (https://github.com/marcofucci), Andrei Coman (https://github.com/comandrei), Ali Hasan Imam (https://github.com/alihasanimam), Joel Hillacre (https://github.com/jhillacre), Peter Mack (https://github.com/pmack)
|
|
6
|
+
Maintainer-email: Arrai Innovations <support@arrai.com>
|
|
7
|
+
Project-URL: repository, https://github.com/arrai-innovations/django-session-security-continued
|
|
8
|
+
Classifier: Development Status :: 5 - Production/Stable
|
|
9
|
+
Classifier: Environment :: Web Environment
|
|
10
|
+
Classifier: Framework :: Django
|
|
11
|
+
Classifier: Framework :: Django :: 4.2
|
|
12
|
+
Classifier: Framework :: Django :: 5.0
|
|
13
|
+
Classifier: Framework :: Django :: 5.1
|
|
14
|
+
Classifier: Framework :: Django :: 5.2
|
|
15
|
+
Classifier: Intended Audience :: Developers
|
|
16
|
+
Classifier: Operating System :: OS Independent
|
|
17
|
+
Classifier: Programming Language :: Python
|
|
18
|
+
Classifier: Programming Language :: Python :: 3
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.9
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
21
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
22
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
23
|
+
Classifier: Topic :: Internet :: WWW/HTTP
|
|
24
|
+
Classifier: Topic :: Software Development :: Libraries :: Python Modules
|
|
25
|
+
Requires-Python: >=3.9
|
|
26
|
+
Description-Content-Type: text/markdown
|
|
27
|
+
License-File: LICENSE
|
|
28
|
+
Requires-Dist: django<5.3,>=4.2
|
|
29
|
+
Dynamic: license-file
|
|
30
|
+
|
|
31
|
+
# django-session-security-continued
|
|
32
|
+
|
|
33
|
+
[![code style: ruff][]][ruff] [![code style: prettier][]][prettier] ![ruff status][] ![pip-audit status][]
|
|
34
|
+
|
|
35
|
+
![python 3.9 status][]
|
|
36
|
+
![python 3.10 status][]
|
|
37
|
+
![python 3.11 status][]
|
|
38
|
+
![python 3.12 status][]
|
|
39
|
+
![coverage status][]
|
|
40
|
+
|
|
41
|
+
<!--prettier-ignore-start-->
|
|
42
|
+
<!--TOC-->
|
|
43
|
+
|
|
44
|
+
- [About](#about)
|
|
45
|
+
- [Requirements / Compatibility](#requirements--compatibility)
|
|
46
|
+
- [Installation](#installation)
|
|
47
|
+
- [Single Sign-On (SSO) Considerations](#single-sign-on-sso-considerations)
|
|
48
|
+
- [Development](#development)
|
|
49
|
+
- [Testing](#testing)
|
|
50
|
+
- [JavaScript coverage](#javascript-coverage)
|
|
51
|
+
- [Contributing](#contributing)
|
|
52
|
+
|
|
53
|
+
<!--TOC-->
|
|
54
|
+
<!--prettier-ignore-end-->
|
|
55
|
+
|
|
56
|
+
## About
|
|
57
|
+
|
|
58
|
+
A minimal JavaScript and Django middleware app that automatically logs out users after inactivity. It tracks activity across all browser tabs, warns users before logging them out, and protects sensitive data.
|
|
59
|
+
|
|
60
|
+
Built for CRMs, intranets, and similar applications, it prevents abandoned sessions from staying open when users leave their workstations. Unlike simply setting session expiry, this approach ensures users aren’t logged out while reading, reviewing data, or filling out forms; preserving their work and reducing frustration while still enforcing inactivity-based security.
|
|
61
|
+
|
|
62
|
+
This fork is maintained by Arrai Innovations Inc. based on the original [`django-session-security`](https://github.com/yourlabs/django-session-security) by Yourlabs.
|
|
63
|
+
|
|
64
|
+
## Requirements / Compatibility
|
|
65
|
+
|
|
66
|
+
- **Django:** 4.2, 5.2
|
|
67
|
+
- `django.contrib.staticfiles`
|
|
68
|
+
- **Python:** 3.9, 3.10, 3.11, 3.12
|
|
69
|
+
|
|
70
|
+
## Installation
|
|
71
|
+
|
|
72
|
+
```console
|
|
73
|
+
# Install the package
|
|
74
|
+
$ pip install django-session-security-continued
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
```python
|
|
78
|
+
# settings.py
|
|
79
|
+
|
|
80
|
+
INSTALLED_APPS = [
|
|
81
|
+
# Add the app
|
|
82
|
+
'session_security',
|
|
83
|
+
# ...
|
|
84
|
+
]
|
|
85
|
+
|
|
86
|
+
MIDDLEWARE = [
|
|
87
|
+
# Make sure this comes AFTER the authentication middleware
|
|
88
|
+
'django.contrib.auth.middleware.AuthenticationMiddleware',
|
|
89
|
+
'session_security.middleware.SessionSecurityMiddleware',
|
|
90
|
+
# ...
|
|
91
|
+
]
|
|
92
|
+
|
|
93
|
+
TEMPLATES = [
|
|
94
|
+
{
|
|
95
|
+
# ...
|
|
96
|
+
'OPTIONS': {
|
|
97
|
+
'context_processors': [
|
|
98
|
+
# Ensure this is present
|
|
99
|
+
'django.template.context_processors.request',
|
|
100
|
+
# ...
|
|
101
|
+
],
|
|
102
|
+
},
|
|
103
|
+
},
|
|
104
|
+
]
|
|
105
|
+
|
|
106
|
+
# Optional settings (see configuration section for details)
|
|
107
|
+
SESSION_SECURITY_WARN_AFTER = 540 # Warn user after 9 minutes
|
|
108
|
+
SESSION_SECURITY_EXPIRE_AFTER = 600 # Log out after 10 minutes
|
|
109
|
+
SESSION_SECURITY_PASSIVE_URLS = [] # URLs that won’t reset the timer
|
|
110
|
+
SESSION_SECURITY_REDIRECT_TO_LOGOUT = False # Set True for SSO setups
|
|
111
|
+
SESSION_SECURITY_PING_URL = '/session_security/ping/' # Activity endpoint
|
|
112
|
+
SESSION_SECURITY_JS_PATH = 'session_security/script.js' # Override to load custom bundles (tests/coverage)
|
|
113
|
+
```
|
|
114
|
+
|
|
115
|
+
```python
|
|
116
|
+
# urls.py
|
|
117
|
+
|
|
118
|
+
from django.urls import include, path
|
|
119
|
+
|
|
120
|
+
urlpatterns = [
|
|
121
|
+
# Add this route to enable the session security endpoints
|
|
122
|
+
path('session_security/', include('session_security.urls')),
|
|
123
|
+
# ...
|
|
124
|
+
]
|
|
125
|
+
```
|
|
126
|
+
|
|
127
|
+
```html
|
|
128
|
+
<!-- base.html (or equivalent) -->
|
|
129
|
+
{% load static %}
|
|
130
|
+
...
|
|
131
|
+
{% include "session_security/all.html" %}
|
|
132
|
+
<script>
|
|
133
|
+
// optional: disable form discard confirmation dialog
|
|
134
|
+
sessionSecurity.confirmFormDiscard = undefined;
|
|
135
|
+
// optional: register custom activity
|
|
136
|
+
sessionSecurity.activity();
|
|
137
|
+
</script>
|
|
138
|
+
```
|
|
139
|
+
|
|
140
|
+
## Single Sign-On (SSO) Considerations
|
|
141
|
+
|
|
142
|
+
When using SSO, the default page reload after timeout may cause automatic re-login if the SSO session remains valid. Set `SESSION_SECURITY_REDIRECT_TO_LOGOUT = True` to explicitly end the app session by redirecting to `LOGOUT_REDIRECT_URL`. Note that this does **not** terminate the SSO provider session; configure a matching timeout on your SSO server for full coverage.
|
|
143
|
+
|
|
144
|
+
## Development
|
|
145
|
+
|
|
146
|
+
This project uses `uv` for managing the development environment. To set up the development environment, follow these steps:
|
|
147
|
+
|
|
148
|
+
```console
|
|
149
|
+
# Clone the repository
|
|
150
|
+
$ git clone https://github.com/arrai-innovations/django-session-security-continued.git
|
|
151
|
+
$ cd django-session-security-continued
|
|
152
|
+
|
|
153
|
+
# Ensure a compatible Python (>=3.9) is installed
|
|
154
|
+
|
|
155
|
+
# Install uv if not already installed
|
|
156
|
+
$ pip install --user --upgrade uv
|
|
157
|
+
|
|
158
|
+
# Create and sync the dev environment
|
|
159
|
+
# (default group includes dev dependencies)
|
|
160
|
+
$ uv sync
|
|
161
|
+
|
|
162
|
+
# (Optional) Run Git hooks setup
|
|
163
|
+
$ uv run pre-commit install
|
|
164
|
+
|
|
165
|
+
# Install JS tooling for the client bundle / coverage builds
|
|
166
|
+
$ npm install
|
|
167
|
+
```
|
|
168
|
+
|
|
169
|
+
## Testing
|
|
170
|
+
|
|
171
|
+
Chrome is required for the Selenium end-to-end tests (Selenium Manager will download the matching chromedriver automatically). Run the full suite with pytest:
|
|
172
|
+
|
|
173
|
+
```console
|
|
174
|
+
$ uv run pytest
|
|
175
|
+
```
|
|
176
|
+
|
|
177
|
+
If Chrome isn’t available (or you only want the fast unit tests), skip the browser suite with `uv run pytest -m "not selenium"`.
|
|
178
|
+
|
|
179
|
+
Add extra breathing room to the Selenium waits (in CI) by exporting `SESSION_SECURITY_TIMEOUT_PADDING` (in seconds). For example, `SESSION_SECURITY_TIMEOUT_PADDING=5 uv run pytest -k selenium` gives each warning/expiry wait up to five additional seconds before failing.
|
|
180
|
+
|
|
181
|
+
### JavaScript coverage
|
|
182
|
+
|
|
183
|
+
We ship a Vite + Istanbul build that instruments the client bundle and collects coverage from the Selenium run:
|
|
184
|
+
|
|
185
|
+
1. `npm run build:coverage`
|
|
186
|
+
2. `SESSION_SECURITY_JS_COVERAGE=1 uv run pytest -k selenium`
|
|
187
|
+
3. `npm run coverage:report` (writes reports to `coverage-js/` and `lcov.info`)
|
|
188
|
+
|
|
189
|
+
The `SESSION_SECURITY_JS_COVERAGE` flag makes the Django test settings load the instrumented bundle and dumps `window.__coverage__` into `.nyc_output/` after each Selenium test.
|
|
190
|
+
|
|
191
|
+
## Contributing
|
|
192
|
+
|
|
193
|
+
Contributions are welcome. Please fork the repository and create a pull request with your changes. We reserve the right to review and modify your contributions before merging them into the main branch. By submitting a change you confirm that:
|
|
194
|
+
|
|
195
|
+
- You wrote the code (or have the right to contribute it), and
|
|
196
|
+
- You’re happy for it to be released under this project’s MIT license.
|
|
197
|
+
|
|
198
|
+
[code style: ruff]: https://img.shields.io/badge/code%20style-ruff-000000.svg?style=for-the-badge
|
|
199
|
+
[ruff]: https://docs.astral.sh/ruff/formatter/#style-guide
|
|
200
|
+
[code style: prettier]: https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=for-the-badge
|
|
201
|
+
[prettier]: https://github.com/prettier/prettier
|
|
202
|
+
[python 3.9 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.9.svg
|
|
203
|
+
[python 3.10 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.10.svg
|
|
204
|
+
[python 3.11 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.11.svg
|
|
205
|
+
[python 3.12 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.12.svg
|
|
206
|
+
[coverage status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.9.coverage.svg
|
|
207
|
+
[ruff status]: https://docs.arrai.dev/dssc/artifacts/main/ruff.svg
|
|
208
|
+
[pipenv]: https://github.com/pypa/pipenv
|
|
209
|
+
[pip-audit status]: https://docs.arrai.dev/dssc/artifacts/main/pip-audit.svg
|
|
@@ -0,0 +1,179 @@
|
|
|
1
|
+
# django-session-security-continued
|
|
2
|
+
|
|
3
|
+
[![code style: ruff][]][ruff] [![code style: prettier][]][prettier] ![ruff status][] ![pip-audit status][]
|
|
4
|
+
|
|
5
|
+
![python 3.9 status][]
|
|
6
|
+
![python 3.10 status][]
|
|
7
|
+
![python 3.11 status][]
|
|
8
|
+
![python 3.12 status][]
|
|
9
|
+
![coverage status][]
|
|
10
|
+
|
|
11
|
+
<!--prettier-ignore-start-->
|
|
12
|
+
<!--TOC-->
|
|
13
|
+
|
|
14
|
+
- [About](#about)
|
|
15
|
+
- [Requirements / Compatibility](#requirements--compatibility)
|
|
16
|
+
- [Installation](#installation)
|
|
17
|
+
- [Single Sign-On (SSO) Considerations](#single-sign-on-sso-considerations)
|
|
18
|
+
- [Development](#development)
|
|
19
|
+
- [Testing](#testing)
|
|
20
|
+
- [JavaScript coverage](#javascript-coverage)
|
|
21
|
+
- [Contributing](#contributing)
|
|
22
|
+
|
|
23
|
+
<!--TOC-->
|
|
24
|
+
<!--prettier-ignore-end-->
|
|
25
|
+
|
|
26
|
+
## About
|
|
27
|
+
|
|
28
|
+
A minimal JavaScript and Django middleware app that automatically logs out users after inactivity. It tracks activity across all browser tabs, warns users before logging them out, and protects sensitive data.
|
|
29
|
+
|
|
30
|
+
Built for CRMs, intranets, and similar applications, it prevents abandoned sessions from staying open when users leave their workstations. Unlike simply setting session expiry, this approach ensures users aren’t logged out while reading, reviewing data, or filling out forms; preserving their work and reducing frustration while still enforcing inactivity-based security.
|
|
31
|
+
|
|
32
|
+
This fork is maintained by Arrai Innovations Inc. based on the original [`django-session-security`](https://github.com/yourlabs/django-session-security) by Yourlabs.
|
|
33
|
+
|
|
34
|
+
## Requirements / Compatibility
|
|
35
|
+
|
|
36
|
+
- **Django:** 4.2, 5.2
|
|
37
|
+
- `django.contrib.staticfiles`
|
|
38
|
+
- **Python:** 3.9, 3.10, 3.11, 3.12
|
|
39
|
+
|
|
40
|
+
## Installation
|
|
41
|
+
|
|
42
|
+
```console
|
|
43
|
+
# Install the package
|
|
44
|
+
$ pip install django-session-security-continued
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
```python
|
|
48
|
+
# settings.py
|
|
49
|
+
|
|
50
|
+
INSTALLED_APPS = [
|
|
51
|
+
# Add the app
|
|
52
|
+
'session_security',
|
|
53
|
+
# ...
|
|
54
|
+
]
|
|
55
|
+
|
|
56
|
+
MIDDLEWARE = [
|
|
57
|
+
# Make sure this comes AFTER the authentication middleware
|
|
58
|
+
'django.contrib.auth.middleware.AuthenticationMiddleware',
|
|
59
|
+
'session_security.middleware.SessionSecurityMiddleware',
|
|
60
|
+
# ...
|
|
61
|
+
]
|
|
62
|
+
|
|
63
|
+
TEMPLATES = [
|
|
64
|
+
{
|
|
65
|
+
# ...
|
|
66
|
+
'OPTIONS': {
|
|
67
|
+
'context_processors': [
|
|
68
|
+
# Ensure this is present
|
|
69
|
+
'django.template.context_processors.request',
|
|
70
|
+
# ...
|
|
71
|
+
],
|
|
72
|
+
},
|
|
73
|
+
},
|
|
74
|
+
]
|
|
75
|
+
|
|
76
|
+
# Optional settings (see configuration section for details)
|
|
77
|
+
SESSION_SECURITY_WARN_AFTER = 540 # Warn user after 9 minutes
|
|
78
|
+
SESSION_SECURITY_EXPIRE_AFTER = 600 # Log out after 10 minutes
|
|
79
|
+
SESSION_SECURITY_PASSIVE_URLS = [] # URLs that won’t reset the timer
|
|
80
|
+
SESSION_SECURITY_REDIRECT_TO_LOGOUT = False # Set True for SSO setups
|
|
81
|
+
SESSION_SECURITY_PING_URL = '/session_security/ping/' # Activity endpoint
|
|
82
|
+
SESSION_SECURITY_JS_PATH = 'session_security/script.js' # Override to load custom bundles (tests/coverage)
|
|
83
|
+
```
|
|
84
|
+
|
|
85
|
+
```python
|
|
86
|
+
# urls.py
|
|
87
|
+
|
|
88
|
+
from django.urls import include, path
|
|
89
|
+
|
|
90
|
+
urlpatterns = [
|
|
91
|
+
# Add this route to enable the session security endpoints
|
|
92
|
+
path('session_security/', include('session_security.urls')),
|
|
93
|
+
# ...
|
|
94
|
+
]
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
```html
|
|
98
|
+
<!-- base.html (or equivalent) -->
|
|
99
|
+
{% load static %}
|
|
100
|
+
...
|
|
101
|
+
{% include "session_security/all.html" %}
|
|
102
|
+
<script>
|
|
103
|
+
// optional: disable form discard confirmation dialog
|
|
104
|
+
sessionSecurity.confirmFormDiscard = undefined;
|
|
105
|
+
// optional: register custom activity
|
|
106
|
+
sessionSecurity.activity();
|
|
107
|
+
</script>
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
## Single Sign-On (SSO) Considerations
|
|
111
|
+
|
|
112
|
+
When using SSO, the default page reload after timeout may cause automatic re-login if the SSO session remains valid. Set `SESSION_SECURITY_REDIRECT_TO_LOGOUT = True` to explicitly end the app session by redirecting to `LOGOUT_REDIRECT_URL`. Note that this does **not** terminate the SSO provider session; configure a matching timeout on your SSO server for full coverage.
|
|
113
|
+
|
|
114
|
+
## Development
|
|
115
|
+
|
|
116
|
+
This project uses `uv` for managing the development environment. To set up the development environment, follow these steps:
|
|
117
|
+
|
|
118
|
+
```console
|
|
119
|
+
# Clone the repository
|
|
120
|
+
$ git clone https://github.com/arrai-innovations/django-session-security-continued.git
|
|
121
|
+
$ cd django-session-security-continued
|
|
122
|
+
|
|
123
|
+
# Ensure a compatible Python (>=3.9) is installed
|
|
124
|
+
|
|
125
|
+
# Install uv if not already installed
|
|
126
|
+
$ pip install --user --upgrade uv
|
|
127
|
+
|
|
128
|
+
# Create and sync the dev environment
|
|
129
|
+
# (default group includes dev dependencies)
|
|
130
|
+
$ uv sync
|
|
131
|
+
|
|
132
|
+
# (Optional) Run Git hooks setup
|
|
133
|
+
$ uv run pre-commit install
|
|
134
|
+
|
|
135
|
+
# Install JS tooling for the client bundle / coverage builds
|
|
136
|
+
$ npm install
|
|
137
|
+
```
|
|
138
|
+
|
|
139
|
+
## Testing
|
|
140
|
+
|
|
141
|
+
Chrome is required for the Selenium end-to-end tests (Selenium Manager will download the matching chromedriver automatically). Run the full suite with pytest:
|
|
142
|
+
|
|
143
|
+
```console
|
|
144
|
+
$ uv run pytest
|
|
145
|
+
```
|
|
146
|
+
|
|
147
|
+
If Chrome isn’t available (or you only want the fast unit tests), skip the browser suite with `uv run pytest -m "not selenium"`.
|
|
148
|
+
|
|
149
|
+
Add extra breathing room to the Selenium waits (in CI) by exporting `SESSION_SECURITY_TIMEOUT_PADDING` (in seconds). For example, `SESSION_SECURITY_TIMEOUT_PADDING=5 uv run pytest -k selenium` gives each warning/expiry wait up to five additional seconds before failing.
|
|
150
|
+
|
|
151
|
+
### JavaScript coverage
|
|
152
|
+
|
|
153
|
+
We ship a Vite + Istanbul build that instruments the client bundle and collects coverage from the Selenium run:
|
|
154
|
+
|
|
155
|
+
1. `npm run build:coverage`
|
|
156
|
+
2. `SESSION_SECURITY_JS_COVERAGE=1 uv run pytest -k selenium`
|
|
157
|
+
3. `npm run coverage:report` (writes reports to `coverage-js/` and `lcov.info`)
|
|
158
|
+
|
|
159
|
+
The `SESSION_SECURITY_JS_COVERAGE` flag makes the Django test settings load the instrumented bundle and dumps `window.__coverage__` into `.nyc_output/` after each Selenium test.
|
|
160
|
+
|
|
161
|
+
## Contributing
|
|
162
|
+
|
|
163
|
+
Contributions are welcome. Please fork the repository and create a pull request with your changes. We reserve the right to review and modify your contributions before merging them into the main branch. By submitting a change you confirm that:
|
|
164
|
+
|
|
165
|
+
- You wrote the code (or have the right to contribute it), and
|
|
166
|
+
- You’re happy for it to be released under this project’s MIT license.
|
|
167
|
+
|
|
168
|
+
[code style: ruff]: https://img.shields.io/badge/code%20style-ruff-000000.svg?style=for-the-badge
|
|
169
|
+
[ruff]: https://docs.astral.sh/ruff/formatter/#style-guide
|
|
170
|
+
[code style: prettier]: https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=for-the-badge
|
|
171
|
+
[prettier]: https://github.com/prettier/prettier
|
|
172
|
+
[python 3.9 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.9.svg
|
|
173
|
+
[python 3.10 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.10.svg
|
|
174
|
+
[python 3.11 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.11.svg
|
|
175
|
+
[python 3.12 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.12.svg
|
|
176
|
+
[coverage status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.9.coverage.svg
|
|
177
|
+
[ruff status]: https://docs.arrai.dev/dssc/artifacts/main/ruff.svg
|
|
178
|
+
[pipenv]: https://github.com/pypa/pipenv
|
|
179
|
+
[pip-audit status]: https://docs.arrai.dev/dssc/artifacts/main/pip-audit.svg
|
|
@@ -0,0 +1,209 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: django-session-security-continued
|
|
3
|
+
Version: 3.0.0a1
|
|
4
|
+
Summary: Client and server-side session timeout enforcement with warnings for Django 4.2+.
|
|
5
|
+
Author: Matt Bosworth (https://github.com/mattbo), Fabio Caritas Barrionuevo da Luz (https://github.com/luzfcb), Pēteris Caune (https://github.com/cuu508), John David Giese (https://github.com/johndgiese), Jose Antonio Martin Prieto (https://github.com/jantoniomartin), Richard Moorhead (https://github.com/autodidacticon), Jean-Michel Nirgal Vourgère (https://github.com/nirgal), Michał Pasternak (https://github.com/mpasternak), James Pic (https://github.com/jpic), Matthew Schettler (https://github.com/mschettler), Scott Sexton (https://github.com/scottsexton), Jacek Ostański (https://github.com/jacoor), Aaron Krill (https://github.com/krillr), @yscumc (https://github.com/yscumc), Marco Fucci (https://github.com/marcofucci), Andrei Coman (https://github.com/comandrei), Ali Hasan Imam (https://github.com/alihasanimam), Joel Hillacre (https://github.com/jhillacre), Peter Mack (https://github.com/pmack)
|
|
6
|
+
Maintainer-email: Arrai Innovations <support@arrai.com>
|
|
7
|
+
Project-URL: repository, https://github.com/arrai-innovations/django-session-security-continued
|
|
8
|
+
Classifier: Development Status :: 5 - Production/Stable
|
|
9
|
+
Classifier: Environment :: Web Environment
|
|
10
|
+
Classifier: Framework :: Django
|
|
11
|
+
Classifier: Framework :: Django :: 4.2
|
|
12
|
+
Classifier: Framework :: Django :: 5.0
|
|
13
|
+
Classifier: Framework :: Django :: 5.1
|
|
14
|
+
Classifier: Framework :: Django :: 5.2
|
|
15
|
+
Classifier: Intended Audience :: Developers
|
|
16
|
+
Classifier: Operating System :: OS Independent
|
|
17
|
+
Classifier: Programming Language :: Python
|
|
18
|
+
Classifier: Programming Language :: Python :: 3
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.9
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
21
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
22
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
23
|
+
Classifier: Topic :: Internet :: WWW/HTTP
|
|
24
|
+
Classifier: Topic :: Software Development :: Libraries :: Python Modules
|
|
25
|
+
Requires-Python: >=3.9
|
|
26
|
+
Description-Content-Type: text/markdown
|
|
27
|
+
License-File: LICENSE
|
|
28
|
+
Requires-Dist: django<5.3,>=4.2
|
|
29
|
+
Dynamic: license-file
|
|
30
|
+
|
|
31
|
+
# django-session-security-continued
|
|
32
|
+
|
|
33
|
+
[![code style: ruff][]][ruff] [![code style: prettier][]][prettier] ![ruff status][] ![pip-audit status][]
|
|
34
|
+
|
|
35
|
+
![python 3.9 status][]
|
|
36
|
+
![python 3.10 status][]
|
|
37
|
+
![python 3.11 status][]
|
|
38
|
+
![python 3.12 status][]
|
|
39
|
+
![coverage status][]
|
|
40
|
+
|
|
41
|
+
<!--prettier-ignore-start-->
|
|
42
|
+
<!--TOC-->
|
|
43
|
+
|
|
44
|
+
- [About](#about)
|
|
45
|
+
- [Requirements / Compatibility](#requirements--compatibility)
|
|
46
|
+
- [Installation](#installation)
|
|
47
|
+
- [Single Sign-On (SSO) Considerations](#single-sign-on-sso-considerations)
|
|
48
|
+
- [Development](#development)
|
|
49
|
+
- [Testing](#testing)
|
|
50
|
+
- [JavaScript coverage](#javascript-coverage)
|
|
51
|
+
- [Contributing](#contributing)
|
|
52
|
+
|
|
53
|
+
<!--TOC-->
|
|
54
|
+
<!--prettier-ignore-end-->
|
|
55
|
+
|
|
56
|
+
## About
|
|
57
|
+
|
|
58
|
+
A minimal JavaScript and Django middleware app that automatically logs out users after inactivity. It tracks activity across all browser tabs, warns users before logging them out, and protects sensitive data.
|
|
59
|
+
|
|
60
|
+
Built for CRMs, intranets, and similar applications, it prevents abandoned sessions from staying open when users leave their workstations. Unlike simply setting session expiry, this approach ensures users aren’t logged out while reading, reviewing data, or filling out forms; preserving their work and reducing frustration while still enforcing inactivity-based security.
|
|
61
|
+
|
|
62
|
+
This fork is maintained by Arrai Innovations Inc. based on the original [`django-session-security`](https://github.com/yourlabs/django-session-security) by Yourlabs.
|
|
63
|
+
|
|
64
|
+
## Requirements / Compatibility
|
|
65
|
+
|
|
66
|
+
- **Django:** 4.2, 5.2
|
|
67
|
+
- `django.contrib.staticfiles`
|
|
68
|
+
- **Python:** 3.9, 3.10, 3.11, 3.12
|
|
69
|
+
|
|
70
|
+
## Installation
|
|
71
|
+
|
|
72
|
+
```console
|
|
73
|
+
# Install the package
|
|
74
|
+
$ pip install django-session-security-continued
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
```python
|
|
78
|
+
# settings.py
|
|
79
|
+
|
|
80
|
+
INSTALLED_APPS = [
|
|
81
|
+
# Add the app
|
|
82
|
+
'session_security',
|
|
83
|
+
# ...
|
|
84
|
+
]
|
|
85
|
+
|
|
86
|
+
MIDDLEWARE = [
|
|
87
|
+
# Make sure this comes AFTER the authentication middleware
|
|
88
|
+
'django.contrib.auth.middleware.AuthenticationMiddleware',
|
|
89
|
+
'session_security.middleware.SessionSecurityMiddleware',
|
|
90
|
+
# ...
|
|
91
|
+
]
|
|
92
|
+
|
|
93
|
+
TEMPLATES = [
|
|
94
|
+
{
|
|
95
|
+
# ...
|
|
96
|
+
'OPTIONS': {
|
|
97
|
+
'context_processors': [
|
|
98
|
+
# Ensure this is present
|
|
99
|
+
'django.template.context_processors.request',
|
|
100
|
+
# ...
|
|
101
|
+
],
|
|
102
|
+
},
|
|
103
|
+
},
|
|
104
|
+
]
|
|
105
|
+
|
|
106
|
+
# Optional settings (see configuration section for details)
|
|
107
|
+
SESSION_SECURITY_WARN_AFTER = 540 # Warn user after 9 minutes
|
|
108
|
+
SESSION_SECURITY_EXPIRE_AFTER = 600 # Log out after 10 minutes
|
|
109
|
+
SESSION_SECURITY_PASSIVE_URLS = [] # URLs that won’t reset the timer
|
|
110
|
+
SESSION_SECURITY_REDIRECT_TO_LOGOUT = False # Set True for SSO setups
|
|
111
|
+
SESSION_SECURITY_PING_URL = '/session_security/ping/' # Activity endpoint
|
|
112
|
+
SESSION_SECURITY_JS_PATH = 'session_security/script.js' # Override to load custom bundles (tests/coverage)
|
|
113
|
+
```
|
|
114
|
+
|
|
115
|
+
```python
|
|
116
|
+
# urls.py
|
|
117
|
+
|
|
118
|
+
from django.urls import include, path
|
|
119
|
+
|
|
120
|
+
urlpatterns = [
|
|
121
|
+
# Add this route to enable the session security endpoints
|
|
122
|
+
path('session_security/', include('session_security.urls')),
|
|
123
|
+
# ...
|
|
124
|
+
]
|
|
125
|
+
```
|
|
126
|
+
|
|
127
|
+
```html
|
|
128
|
+
<!-- base.html (or equivalent) -->
|
|
129
|
+
{% load static %}
|
|
130
|
+
...
|
|
131
|
+
{% include "session_security/all.html" %}
|
|
132
|
+
<script>
|
|
133
|
+
// optional: disable form discard confirmation dialog
|
|
134
|
+
sessionSecurity.confirmFormDiscard = undefined;
|
|
135
|
+
// optional: register custom activity
|
|
136
|
+
sessionSecurity.activity();
|
|
137
|
+
</script>
|
|
138
|
+
```
|
|
139
|
+
|
|
140
|
+
## Single Sign-On (SSO) Considerations
|
|
141
|
+
|
|
142
|
+
When using SSO, the default page reload after timeout may cause automatic re-login if the SSO session remains valid. Set `SESSION_SECURITY_REDIRECT_TO_LOGOUT = True` to explicitly end the app session by redirecting to `LOGOUT_REDIRECT_URL`. Note that this does **not** terminate the SSO provider session; configure a matching timeout on your SSO server for full coverage.
|
|
143
|
+
|
|
144
|
+
## Development
|
|
145
|
+
|
|
146
|
+
This project uses `uv` for managing the development environment. To set up the development environment, follow these steps:
|
|
147
|
+
|
|
148
|
+
```console
|
|
149
|
+
# Clone the repository
|
|
150
|
+
$ git clone https://github.com/arrai-innovations/django-session-security-continued.git
|
|
151
|
+
$ cd django-session-security-continued
|
|
152
|
+
|
|
153
|
+
# Ensure a compatible Python (>=3.9) is installed
|
|
154
|
+
|
|
155
|
+
# Install uv if not already installed
|
|
156
|
+
$ pip install --user --upgrade uv
|
|
157
|
+
|
|
158
|
+
# Create and sync the dev environment
|
|
159
|
+
# (default group includes dev dependencies)
|
|
160
|
+
$ uv sync
|
|
161
|
+
|
|
162
|
+
# (Optional) Run Git hooks setup
|
|
163
|
+
$ uv run pre-commit install
|
|
164
|
+
|
|
165
|
+
# Install JS tooling for the client bundle / coverage builds
|
|
166
|
+
$ npm install
|
|
167
|
+
```
|
|
168
|
+
|
|
169
|
+
## Testing
|
|
170
|
+
|
|
171
|
+
Chrome is required for the Selenium end-to-end tests (Selenium Manager will download the matching chromedriver automatically). Run the full suite with pytest:
|
|
172
|
+
|
|
173
|
+
```console
|
|
174
|
+
$ uv run pytest
|
|
175
|
+
```
|
|
176
|
+
|
|
177
|
+
If Chrome isn’t available (or you only want the fast unit tests), skip the browser suite with `uv run pytest -m "not selenium"`.
|
|
178
|
+
|
|
179
|
+
Add extra breathing room to the Selenium waits (in CI) by exporting `SESSION_SECURITY_TIMEOUT_PADDING` (in seconds). For example, `SESSION_SECURITY_TIMEOUT_PADDING=5 uv run pytest -k selenium` gives each warning/expiry wait up to five additional seconds before failing.
|
|
180
|
+
|
|
181
|
+
### JavaScript coverage
|
|
182
|
+
|
|
183
|
+
We ship a Vite + Istanbul build that instruments the client bundle and collects coverage from the Selenium run:
|
|
184
|
+
|
|
185
|
+
1. `npm run build:coverage`
|
|
186
|
+
2. `SESSION_SECURITY_JS_COVERAGE=1 uv run pytest -k selenium`
|
|
187
|
+
3. `npm run coverage:report` (writes reports to `coverage-js/` and `lcov.info`)
|
|
188
|
+
|
|
189
|
+
The `SESSION_SECURITY_JS_COVERAGE` flag makes the Django test settings load the instrumented bundle and dumps `window.__coverage__` into `.nyc_output/` after each Selenium test.
|
|
190
|
+
|
|
191
|
+
## Contributing
|
|
192
|
+
|
|
193
|
+
Contributions are welcome. Please fork the repository and create a pull request with your changes. We reserve the right to review and modify your contributions before merging them into the main branch. By submitting a change you confirm that:
|
|
194
|
+
|
|
195
|
+
- You wrote the code (or have the right to contribute it), and
|
|
196
|
+
- You’re happy for it to be released under this project’s MIT license.
|
|
197
|
+
|
|
198
|
+
[code style: ruff]: https://img.shields.io/badge/code%20style-ruff-000000.svg?style=for-the-badge
|
|
199
|
+
[ruff]: https://docs.astral.sh/ruff/formatter/#style-guide
|
|
200
|
+
[code style: prettier]: https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=for-the-badge
|
|
201
|
+
[prettier]: https://github.com/prettier/prettier
|
|
202
|
+
[python 3.9 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.9.svg
|
|
203
|
+
[python 3.10 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.10.svg
|
|
204
|
+
[python 3.11 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.11.svg
|
|
205
|
+
[python 3.12 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.12.svg
|
|
206
|
+
[coverage status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.9.coverage.svg
|
|
207
|
+
[ruff status]: https://docs.arrai.dev/dssc/artifacts/main/ruff.svg
|
|
208
|
+
[pipenv]: https://github.com/pypa/pipenv
|
|
209
|
+
[pip-audit status]: https://docs.arrai.dev/dssc/artifacts/main/pip-audit.svg
|
django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/SOURCES.txt
ADDED
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
LICENSE
|
|
2
|
+
README.md
|
|
3
|
+
pyproject.toml
|
|
4
|
+
./session_security/__init__.py
|
|
5
|
+
./session_security/middleware.py
|
|
6
|
+
./session_security/models.py
|
|
7
|
+
./session_security/settings.py
|
|
8
|
+
./session_security/urls.py
|
|
9
|
+
./session_security/utils.py
|
|
10
|
+
./session_security/views.py
|
|
11
|
+
./session_security/templatetags/__init__.py
|
|
12
|
+
./session_security/templatetags/session_security_tags.py
|
|
13
|
+
./session_security/tests/__init__.py
|
|
14
|
+
./session_security/tests/conftest.py
|
|
15
|
+
./session_security/tests/test_base.py
|
|
16
|
+
./session_security/tests/test_middleware.py
|
|
17
|
+
./session_security/tests/test_script.py
|
|
18
|
+
./session_security/tests/test_templates.py
|
|
19
|
+
./session_security/tests/test_views.py
|
|
20
|
+
./session_security/tests/project/__init__.py
|
|
21
|
+
./session_security/tests/project/settings.py
|
|
22
|
+
./session_security/tests/project/urls.py
|
|
23
|
+
./session_security/tests/project/wsgi.py
|
|
24
|
+
django_session_security_continued.egg-info/PKG-INFO
|
|
25
|
+
django_session_security_continued.egg-info/SOURCES.txt
|
|
26
|
+
django_session_security_continued.egg-info/dependency_links.txt
|
|
27
|
+
django_session_security_continued.egg-info/requires.txt
|
|
28
|
+
django_session_security_continued.egg-info/top_level.txt
|
|
29
|
+
session_security/__init__.py
|
|
30
|
+
session_security/middleware.py
|
|
31
|
+
session_security/models.py
|
|
32
|
+
session_security/settings.py
|
|
33
|
+
session_security/urls.py
|
|
34
|
+
session_security/utils.py
|
|
35
|
+
session_security/views.py
|
|
36
|
+
session_security/templatetags/__init__.py
|
|
37
|
+
session_security/templatetags/session_security_tags.py
|
|
38
|
+
session_security/tests/__init__.py
|
|
39
|
+
session_security/tests/conftest.py
|
|
40
|
+
session_security/tests/test_base.py
|
|
41
|
+
session_security/tests/test_middleware.py
|
|
42
|
+
session_security/tests/test_script.py
|
|
43
|
+
session_security/tests/test_templates.py
|
|
44
|
+
session_security/tests/test_views.py
|
|
45
|
+
session_security/tests/project/__init__.py
|
|
46
|
+
session_security/tests/project/settings.py
|
|
47
|
+
session_security/tests/project/urls.py
|
|
48
|
+
session_security/tests/project/wsgi.py
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
|
django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/requires.txt
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
django<5.3,>=4.2
|
django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/top_level.txt
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
session_security
|