django-session-security-continued 3.0.0a1__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. django_session_security_continued-3.0.0a1/LICENSE +22 -0
  2. django_session_security_continued-3.0.0a1/PKG-INFO +209 -0
  3. django_session_security_continued-3.0.0a1/README.md +179 -0
  4. django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/PKG-INFO +209 -0
  5. django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/SOURCES.txt +48 -0
  6. django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/dependency_links.txt +1 -0
  7. django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/requires.txt +1 -0
  8. django_session_security_continued-3.0.0a1/django_session_security_continued.egg-info/top_level.txt +1 -0
  9. django_session_security_continued-3.0.0a1/pyproject.toml +221 -0
  10. django_session_security_continued-3.0.0a1/session_security/__init__.py +0 -0
  11. django_session_security_continued-3.0.0a1/session_security/middleware.py +119 -0
  12. django_session_security_continued-3.0.0a1/session_security/models.py +0 -0
  13. django_session_security_continued-3.0.0a1/session_security/settings.py +53 -0
  14. django_session_security_continued-3.0.0a1/session_security/templatetags/__init__.py +0 -0
  15. django_session_security_continued-3.0.0a1/session_security/templatetags/session_security_tags.py +29 -0
  16. django_session_security_continued-3.0.0a1/session_security/tests/__init__.py +0 -0
  17. django_session_security_continued-3.0.0a1/session_security/tests/conftest.py +149 -0
  18. django_session_security_continued-3.0.0a1/session_security/tests/project/__init__.py +0 -0
  19. django_session_security_continued-3.0.0a1/session_security/tests/project/settings.py +112 -0
  20. django_session_security_continued-3.0.0a1/session_security/tests/project/urls.py +33 -0
  21. django_session_security_continued-3.0.0a1/session_security/tests/project/wsgi.py +20 -0
  22. django_session_security_continued-3.0.0a1/session_security/tests/test_base.py +50 -0
  23. django_session_security_continued-3.0.0a1/session_security/tests/test_middleware.py +87 -0
  24. django_session_security_continued-3.0.0a1/session_security/tests/test_script.py +77 -0
  25. django_session_security_continued-3.0.0a1/session_security/tests/test_templates.py +17 -0
  26. django_session_security_continued-3.0.0a1/session_security/tests/test_views.py +43 -0
  27. django_session_security_continued-3.0.0a1/session_security/urls.py +29 -0
  28. django_session_security_continued-3.0.0a1/session_security/utils.py +14 -0
  29. django_session_security_continued-3.0.0a1/session_security/views.py +29 -0
  30. django_session_security_continued-3.0.0a1/setup.cfg +4 -0
@@ -0,0 +1,22 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2018 YourLabs
4
+ Copyright (c) 2025 Arrai Innovations Inc.
5
+
6
+ Permission is hereby granted, free of charge, to any person obtaining a copy
7
+ of this software and associated documentation files (the "Software"), to deal
8
+ in the Software without restriction, including without limitation the rights
9
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10
+ copies of the Software, and to permit persons to whom the Software is
11
+ furnished to do so, subject to the following conditions:
12
+
13
+ The above copyright notice and this permission notice shall be included in all
14
+ copies or substantial portions of the Software.
15
+
16
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22
+ SOFTWARE.
@@ -0,0 +1,209 @@
1
+ Metadata-Version: 2.4
2
+ Name: django-session-security-continued
3
+ Version: 3.0.0a1
4
+ Summary: Client and server-side session timeout enforcement with warnings for Django 4.2+.
5
+ Author: Matt Bosworth (https://github.com/mattbo), Fabio Caritas Barrionuevo da Luz (https://github.com/luzfcb), Pēteris Caune (https://github.com/cuu508), John David Giese (https://github.com/johndgiese), Jose Antonio Martin Prieto (https://github.com/jantoniomartin), Richard Moorhead (https://github.com/autodidacticon), Jean-Michel Nirgal Vourgère (https://github.com/nirgal), Michał Pasternak (https://github.com/mpasternak), James Pic (https://github.com/jpic), Matthew Schettler (https://github.com/mschettler), Scott Sexton (https://github.com/scottsexton), Jacek Ostański (https://github.com/jacoor), Aaron Krill (https://github.com/krillr), @yscumc (https://github.com/yscumc), Marco Fucci (https://github.com/marcofucci), Andrei Coman (https://github.com/comandrei), Ali Hasan Imam (https://github.com/alihasanimam), Joel Hillacre (https://github.com/jhillacre), Peter Mack (https://github.com/pmack)
6
+ Maintainer-email: Arrai Innovations <support@arrai.com>
7
+ Project-URL: repository, https://github.com/arrai-innovations/django-session-security-continued
8
+ Classifier: Development Status :: 5 - Production/Stable
9
+ Classifier: Environment :: Web Environment
10
+ Classifier: Framework :: Django
11
+ Classifier: Framework :: Django :: 4.2
12
+ Classifier: Framework :: Django :: 5.0
13
+ Classifier: Framework :: Django :: 5.1
14
+ Classifier: Framework :: Django :: 5.2
15
+ Classifier: Intended Audience :: Developers
16
+ Classifier: Operating System :: OS Independent
17
+ Classifier: Programming Language :: Python
18
+ Classifier: Programming Language :: Python :: 3
19
+ Classifier: Programming Language :: Python :: 3.9
20
+ Classifier: Programming Language :: Python :: 3.10
21
+ Classifier: Programming Language :: Python :: 3.11
22
+ Classifier: Programming Language :: Python :: 3.12
23
+ Classifier: Topic :: Internet :: WWW/HTTP
24
+ Classifier: Topic :: Software Development :: Libraries :: Python Modules
25
+ Requires-Python: >=3.9
26
+ Description-Content-Type: text/markdown
27
+ License-File: LICENSE
28
+ Requires-Dist: django<5.3,>=4.2
29
+ Dynamic: license-file
30
+
31
+ # django-session-security-continued
32
+
33
+ [![code style: ruff][]][ruff] [![code style: prettier][]][prettier] ![ruff status][] ![pip-audit status][]
34
+
35
+ ![python 3.9 status][]
36
+ ![python 3.10 status][]
37
+ ![python 3.11 status][]
38
+ ![python 3.12 status][]
39
+ ![coverage status][]
40
+
41
+ <!--prettier-ignore-start-->
42
+ <!--TOC-->
43
+
44
+ - [About](#about)
45
+ - [Requirements / Compatibility](#requirements--compatibility)
46
+ - [Installation](#installation)
47
+ - [Single Sign-On (SSO) Considerations](#single-sign-on-sso-considerations)
48
+ - [Development](#development)
49
+ - [Testing](#testing)
50
+ - [JavaScript coverage](#javascript-coverage)
51
+ - [Contributing](#contributing)
52
+
53
+ <!--TOC-->
54
+ <!--prettier-ignore-end-->
55
+
56
+ ## About
57
+
58
+ A minimal JavaScript and Django middleware app that automatically logs out users after inactivity. It tracks activity across all browser tabs, warns users before logging them out, and protects sensitive data.
59
+
60
+ Built for CRMs, intranets, and similar applications, it prevents abandoned sessions from staying open when users leave their workstations. Unlike simply setting session expiry, this approach ensures users aren’t logged out while reading, reviewing data, or filling out forms; preserving their work and reducing frustration while still enforcing inactivity-based security.
61
+
62
+ This fork is maintained by Arrai Innovations Inc. based on the original [`django-session-security`](https://github.com/yourlabs/django-session-security) by Yourlabs.
63
+
64
+ ## Requirements / Compatibility
65
+
66
+ - **Django:** 4.2, 5.2
67
+ - `django.contrib.staticfiles`
68
+ - **Python:** 3.9, 3.10, 3.11, 3.12
69
+
70
+ ## Installation
71
+
72
+ ```console
73
+ # Install the package
74
+ $ pip install django-session-security-continued
75
+ ```
76
+
77
+ ```python
78
+ # settings.py
79
+
80
+ INSTALLED_APPS = [
81
+ # Add the app
82
+ 'session_security',
83
+ # ...
84
+ ]
85
+
86
+ MIDDLEWARE = [
87
+ # Make sure this comes AFTER the authentication middleware
88
+ 'django.contrib.auth.middleware.AuthenticationMiddleware',
89
+ 'session_security.middleware.SessionSecurityMiddleware',
90
+ # ...
91
+ ]
92
+
93
+ TEMPLATES = [
94
+ {
95
+ # ...
96
+ 'OPTIONS': {
97
+ 'context_processors': [
98
+ # Ensure this is present
99
+ 'django.template.context_processors.request',
100
+ # ...
101
+ ],
102
+ },
103
+ },
104
+ ]
105
+
106
+ # Optional settings (see configuration section for details)
107
+ SESSION_SECURITY_WARN_AFTER = 540 # Warn user after 9 minutes
108
+ SESSION_SECURITY_EXPIRE_AFTER = 600 # Log out after 10 minutes
109
+ SESSION_SECURITY_PASSIVE_URLS = [] # URLs that won’t reset the timer
110
+ SESSION_SECURITY_REDIRECT_TO_LOGOUT = False # Set True for SSO setups
111
+ SESSION_SECURITY_PING_URL = '/session_security/ping/' # Activity endpoint
112
+ SESSION_SECURITY_JS_PATH = 'session_security/script.js' # Override to load custom bundles (tests/coverage)
113
+ ```
114
+
115
+ ```python
116
+ # urls.py
117
+
118
+ from django.urls import include, path
119
+
120
+ urlpatterns = [
121
+ # Add this route to enable the session security endpoints
122
+ path('session_security/', include('session_security.urls')),
123
+ # ...
124
+ ]
125
+ ```
126
+
127
+ ```html
128
+ <!-- base.html (or equivalent) -->
129
+ {% load static %}
130
+ ...
131
+ {% include "session_security/all.html" %}
132
+ <script>
133
+ // optional: disable form discard confirmation dialog
134
+ sessionSecurity.confirmFormDiscard = undefined;
135
+ // optional: register custom activity
136
+ sessionSecurity.activity();
137
+ </script>
138
+ ```
139
+
140
+ ## Single Sign-On (SSO) Considerations
141
+
142
+ When using SSO, the default page reload after timeout may cause automatic re-login if the SSO session remains valid. Set `SESSION_SECURITY_REDIRECT_TO_LOGOUT = True` to explicitly end the app session by redirecting to `LOGOUT_REDIRECT_URL`. Note that this does **not** terminate the SSO provider session; configure a matching timeout on your SSO server for full coverage.
143
+
144
+ ## Development
145
+
146
+ This project uses `uv` for managing the development environment. To set up the development environment, follow these steps:
147
+
148
+ ```console
149
+ # Clone the repository
150
+ $ git clone https://github.com/arrai-innovations/django-session-security-continued.git
151
+ $ cd django-session-security-continued
152
+
153
+ # Ensure a compatible Python (>=3.9) is installed
154
+
155
+ # Install uv if not already installed
156
+ $ pip install --user --upgrade uv
157
+
158
+ # Create and sync the dev environment
159
+ # (default group includes dev dependencies)
160
+ $ uv sync
161
+
162
+ # (Optional) Run Git hooks setup
163
+ $ uv run pre-commit install
164
+
165
+ # Install JS tooling for the client bundle / coverage builds
166
+ $ npm install
167
+ ```
168
+
169
+ ## Testing
170
+
171
+ Chrome is required for the Selenium end-to-end tests (Selenium Manager will download the matching chromedriver automatically). Run the full suite with pytest:
172
+
173
+ ```console
174
+ $ uv run pytest
175
+ ```
176
+
177
+ If Chrome isn’t available (or you only want the fast unit tests), skip the browser suite with `uv run pytest -m "not selenium"`.
178
+
179
+ Add extra breathing room to the Selenium waits (in CI) by exporting `SESSION_SECURITY_TIMEOUT_PADDING` (in seconds). For example, `SESSION_SECURITY_TIMEOUT_PADDING=5 uv run pytest -k selenium` gives each warning/expiry wait up to five additional seconds before failing.
180
+
181
+ ### JavaScript coverage
182
+
183
+ We ship a Vite + Istanbul build that instruments the client bundle and collects coverage from the Selenium run:
184
+
185
+ 1. `npm run build:coverage`
186
+ 2. `SESSION_SECURITY_JS_COVERAGE=1 uv run pytest -k selenium`
187
+ 3. `npm run coverage:report` (writes reports to `coverage-js/` and `lcov.info`)
188
+
189
+ The `SESSION_SECURITY_JS_COVERAGE` flag makes the Django test settings load the instrumented bundle and dumps `window.__coverage__` into `.nyc_output/` after each Selenium test.
190
+
191
+ ## Contributing
192
+
193
+ Contributions are welcome. Please fork the repository and create a pull request with your changes. We reserve the right to review and modify your contributions before merging them into the main branch. By submitting a change you confirm that:
194
+
195
+ - You wrote the code (or have the right to contribute it), and
196
+ - You’re happy for it to be released under this project’s MIT license.
197
+
198
+ [code style: ruff]: https://img.shields.io/badge/code%20style-ruff-000000.svg?style=for-the-badge
199
+ [ruff]: https://docs.astral.sh/ruff/formatter/#style-guide
200
+ [code style: prettier]: https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=for-the-badge
201
+ [prettier]: https://github.com/prettier/prettier
202
+ [python 3.9 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.9.svg
203
+ [python 3.10 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.10.svg
204
+ [python 3.11 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.11.svg
205
+ [python 3.12 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.12.svg
206
+ [coverage status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.9.coverage.svg
207
+ [ruff status]: https://docs.arrai.dev/dssc/artifacts/main/ruff.svg
208
+ [pipenv]: https://github.com/pypa/pipenv
209
+ [pip-audit status]: https://docs.arrai.dev/dssc/artifacts/main/pip-audit.svg
@@ -0,0 +1,179 @@
1
+ # django-session-security-continued
2
+
3
+ [![code style: ruff][]][ruff] [![code style: prettier][]][prettier] ![ruff status][] ![pip-audit status][]
4
+
5
+ ![python 3.9 status][]
6
+ ![python 3.10 status][]
7
+ ![python 3.11 status][]
8
+ ![python 3.12 status][]
9
+ ![coverage status][]
10
+
11
+ <!--prettier-ignore-start-->
12
+ <!--TOC-->
13
+
14
+ - [About](#about)
15
+ - [Requirements / Compatibility](#requirements--compatibility)
16
+ - [Installation](#installation)
17
+ - [Single Sign-On (SSO) Considerations](#single-sign-on-sso-considerations)
18
+ - [Development](#development)
19
+ - [Testing](#testing)
20
+ - [JavaScript coverage](#javascript-coverage)
21
+ - [Contributing](#contributing)
22
+
23
+ <!--TOC-->
24
+ <!--prettier-ignore-end-->
25
+
26
+ ## About
27
+
28
+ A minimal JavaScript and Django middleware app that automatically logs out users after inactivity. It tracks activity across all browser tabs, warns users before logging them out, and protects sensitive data.
29
+
30
+ Built for CRMs, intranets, and similar applications, it prevents abandoned sessions from staying open when users leave their workstations. Unlike simply setting session expiry, this approach ensures users aren’t logged out while reading, reviewing data, or filling out forms; preserving their work and reducing frustration while still enforcing inactivity-based security.
31
+
32
+ This fork is maintained by Arrai Innovations Inc. based on the original [`django-session-security`](https://github.com/yourlabs/django-session-security) by Yourlabs.
33
+
34
+ ## Requirements / Compatibility
35
+
36
+ - **Django:** 4.2, 5.2
37
+ - `django.contrib.staticfiles`
38
+ - **Python:** 3.9, 3.10, 3.11, 3.12
39
+
40
+ ## Installation
41
+
42
+ ```console
43
+ # Install the package
44
+ $ pip install django-session-security-continued
45
+ ```
46
+
47
+ ```python
48
+ # settings.py
49
+
50
+ INSTALLED_APPS = [
51
+ # Add the app
52
+ 'session_security',
53
+ # ...
54
+ ]
55
+
56
+ MIDDLEWARE = [
57
+ # Make sure this comes AFTER the authentication middleware
58
+ 'django.contrib.auth.middleware.AuthenticationMiddleware',
59
+ 'session_security.middleware.SessionSecurityMiddleware',
60
+ # ...
61
+ ]
62
+
63
+ TEMPLATES = [
64
+ {
65
+ # ...
66
+ 'OPTIONS': {
67
+ 'context_processors': [
68
+ # Ensure this is present
69
+ 'django.template.context_processors.request',
70
+ # ...
71
+ ],
72
+ },
73
+ },
74
+ ]
75
+
76
+ # Optional settings (see configuration section for details)
77
+ SESSION_SECURITY_WARN_AFTER = 540 # Warn user after 9 minutes
78
+ SESSION_SECURITY_EXPIRE_AFTER = 600 # Log out after 10 minutes
79
+ SESSION_SECURITY_PASSIVE_URLS = [] # URLs that won’t reset the timer
80
+ SESSION_SECURITY_REDIRECT_TO_LOGOUT = False # Set True for SSO setups
81
+ SESSION_SECURITY_PING_URL = '/session_security/ping/' # Activity endpoint
82
+ SESSION_SECURITY_JS_PATH = 'session_security/script.js' # Override to load custom bundles (tests/coverage)
83
+ ```
84
+
85
+ ```python
86
+ # urls.py
87
+
88
+ from django.urls import include, path
89
+
90
+ urlpatterns = [
91
+ # Add this route to enable the session security endpoints
92
+ path('session_security/', include('session_security.urls')),
93
+ # ...
94
+ ]
95
+ ```
96
+
97
+ ```html
98
+ <!-- base.html (or equivalent) -->
99
+ {% load static %}
100
+ ...
101
+ {% include "session_security/all.html" %}
102
+ <script>
103
+ // optional: disable form discard confirmation dialog
104
+ sessionSecurity.confirmFormDiscard = undefined;
105
+ // optional: register custom activity
106
+ sessionSecurity.activity();
107
+ </script>
108
+ ```
109
+
110
+ ## Single Sign-On (SSO) Considerations
111
+
112
+ When using SSO, the default page reload after timeout may cause automatic re-login if the SSO session remains valid. Set `SESSION_SECURITY_REDIRECT_TO_LOGOUT = True` to explicitly end the app session by redirecting to `LOGOUT_REDIRECT_URL`. Note that this does **not** terminate the SSO provider session; configure a matching timeout on your SSO server for full coverage.
113
+
114
+ ## Development
115
+
116
+ This project uses `uv` for managing the development environment. To set up the development environment, follow these steps:
117
+
118
+ ```console
119
+ # Clone the repository
120
+ $ git clone https://github.com/arrai-innovations/django-session-security-continued.git
121
+ $ cd django-session-security-continued
122
+
123
+ # Ensure a compatible Python (>=3.9) is installed
124
+
125
+ # Install uv if not already installed
126
+ $ pip install --user --upgrade uv
127
+
128
+ # Create and sync the dev environment
129
+ # (default group includes dev dependencies)
130
+ $ uv sync
131
+
132
+ # (Optional) Run Git hooks setup
133
+ $ uv run pre-commit install
134
+
135
+ # Install JS tooling for the client bundle / coverage builds
136
+ $ npm install
137
+ ```
138
+
139
+ ## Testing
140
+
141
+ Chrome is required for the Selenium end-to-end tests (Selenium Manager will download the matching chromedriver automatically). Run the full suite with pytest:
142
+
143
+ ```console
144
+ $ uv run pytest
145
+ ```
146
+
147
+ If Chrome isn’t available (or you only want the fast unit tests), skip the browser suite with `uv run pytest -m "not selenium"`.
148
+
149
+ Add extra breathing room to the Selenium waits (in CI) by exporting `SESSION_SECURITY_TIMEOUT_PADDING` (in seconds). For example, `SESSION_SECURITY_TIMEOUT_PADDING=5 uv run pytest -k selenium` gives each warning/expiry wait up to five additional seconds before failing.
150
+
151
+ ### JavaScript coverage
152
+
153
+ We ship a Vite + Istanbul build that instruments the client bundle and collects coverage from the Selenium run:
154
+
155
+ 1. `npm run build:coverage`
156
+ 2. `SESSION_SECURITY_JS_COVERAGE=1 uv run pytest -k selenium`
157
+ 3. `npm run coverage:report` (writes reports to `coverage-js/` and `lcov.info`)
158
+
159
+ The `SESSION_SECURITY_JS_COVERAGE` flag makes the Django test settings load the instrumented bundle and dumps `window.__coverage__` into `.nyc_output/` after each Selenium test.
160
+
161
+ ## Contributing
162
+
163
+ Contributions are welcome. Please fork the repository and create a pull request with your changes. We reserve the right to review and modify your contributions before merging them into the main branch. By submitting a change you confirm that:
164
+
165
+ - You wrote the code (or have the right to contribute it), and
166
+ - You’re happy for it to be released under this project’s MIT license.
167
+
168
+ [code style: ruff]: https://img.shields.io/badge/code%20style-ruff-000000.svg?style=for-the-badge
169
+ [ruff]: https://docs.astral.sh/ruff/formatter/#style-guide
170
+ [code style: prettier]: https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=for-the-badge
171
+ [prettier]: https://github.com/prettier/prettier
172
+ [python 3.9 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.9.svg
173
+ [python 3.10 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.10.svg
174
+ [python 3.11 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.11.svg
175
+ [python 3.12 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.12.svg
176
+ [coverage status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.9.coverage.svg
177
+ [ruff status]: https://docs.arrai.dev/dssc/artifacts/main/ruff.svg
178
+ [pipenv]: https://github.com/pypa/pipenv
179
+ [pip-audit status]: https://docs.arrai.dev/dssc/artifacts/main/pip-audit.svg
@@ -0,0 +1,209 @@
1
+ Metadata-Version: 2.4
2
+ Name: django-session-security-continued
3
+ Version: 3.0.0a1
4
+ Summary: Client and server-side session timeout enforcement with warnings for Django 4.2+.
5
+ Author: Matt Bosworth (https://github.com/mattbo), Fabio Caritas Barrionuevo da Luz (https://github.com/luzfcb), Pēteris Caune (https://github.com/cuu508), John David Giese (https://github.com/johndgiese), Jose Antonio Martin Prieto (https://github.com/jantoniomartin), Richard Moorhead (https://github.com/autodidacticon), Jean-Michel Nirgal Vourgère (https://github.com/nirgal), Michał Pasternak (https://github.com/mpasternak), James Pic (https://github.com/jpic), Matthew Schettler (https://github.com/mschettler), Scott Sexton (https://github.com/scottsexton), Jacek Ostański (https://github.com/jacoor), Aaron Krill (https://github.com/krillr), @yscumc (https://github.com/yscumc), Marco Fucci (https://github.com/marcofucci), Andrei Coman (https://github.com/comandrei), Ali Hasan Imam (https://github.com/alihasanimam), Joel Hillacre (https://github.com/jhillacre), Peter Mack (https://github.com/pmack)
6
+ Maintainer-email: Arrai Innovations <support@arrai.com>
7
+ Project-URL: repository, https://github.com/arrai-innovations/django-session-security-continued
8
+ Classifier: Development Status :: 5 - Production/Stable
9
+ Classifier: Environment :: Web Environment
10
+ Classifier: Framework :: Django
11
+ Classifier: Framework :: Django :: 4.2
12
+ Classifier: Framework :: Django :: 5.0
13
+ Classifier: Framework :: Django :: 5.1
14
+ Classifier: Framework :: Django :: 5.2
15
+ Classifier: Intended Audience :: Developers
16
+ Classifier: Operating System :: OS Independent
17
+ Classifier: Programming Language :: Python
18
+ Classifier: Programming Language :: Python :: 3
19
+ Classifier: Programming Language :: Python :: 3.9
20
+ Classifier: Programming Language :: Python :: 3.10
21
+ Classifier: Programming Language :: Python :: 3.11
22
+ Classifier: Programming Language :: Python :: 3.12
23
+ Classifier: Topic :: Internet :: WWW/HTTP
24
+ Classifier: Topic :: Software Development :: Libraries :: Python Modules
25
+ Requires-Python: >=3.9
26
+ Description-Content-Type: text/markdown
27
+ License-File: LICENSE
28
+ Requires-Dist: django<5.3,>=4.2
29
+ Dynamic: license-file
30
+
31
+ # django-session-security-continued
32
+
33
+ [![code style: ruff][]][ruff] [![code style: prettier][]][prettier] ![ruff status][] ![pip-audit status][]
34
+
35
+ ![python 3.9 status][]
36
+ ![python 3.10 status][]
37
+ ![python 3.11 status][]
38
+ ![python 3.12 status][]
39
+ ![coverage status][]
40
+
41
+ <!--prettier-ignore-start-->
42
+ <!--TOC-->
43
+
44
+ - [About](#about)
45
+ - [Requirements / Compatibility](#requirements--compatibility)
46
+ - [Installation](#installation)
47
+ - [Single Sign-On (SSO) Considerations](#single-sign-on-sso-considerations)
48
+ - [Development](#development)
49
+ - [Testing](#testing)
50
+ - [JavaScript coverage](#javascript-coverage)
51
+ - [Contributing](#contributing)
52
+
53
+ <!--TOC-->
54
+ <!--prettier-ignore-end-->
55
+
56
+ ## About
57
+
58
+ A minimal JavaScript and Django middleware app that automatically logs out users after inactivity. It tracks activity across all browser tabs, warns users before logging them out, and protects sensitive data.
59
+
60
+ Built for CRMs, intranets, and similar applications, it prevents abandoned sessions from staying open when users leave their workstations. Unlike simply setting session expiry, this approach ensures users aren’t logged out while reading, reviewing data, or filling out forms; preserving their work and reducing frustration while still enforcing inactivity-based security.
61
+
62
+ This fork is maintained by Arrai Innovations Inc. based on the original [`django-session-security`](https://github.com/yourlabs/django-session-security) by Yourlabs.
63
+
64
+ ## Requirements / Compatibility
65
+
66
+ - **Django:** 4.2, 5.2
67
+ - `django.contrib.staticfiles`
68
+ - **Python:** 3.9, 3.10, 3.11, 3.12
69
+
70
+ ## Installation
71
+
72
+ ```console
73
+ # Install the package
74
+ $ pip install django-session-security-continued
75
+ ```
76
+
77
+ ```python
78
+ # settings.py
79
+
80
+ INSTALLED_APPS = [
81
+ # Add the app
82
+ 'session_security',
83
+ # ...
84
+ ]
85
+
86
+ MIDDLEWARE = [
87
+ # Make sure this comes AFTER the authentication middleware
88
+ 'django.contrib.auth.middleware.AuthenticationMiddleware',
89
+ 'session_security.middleware.SessionSecurityMiddleware',
90
+ # ...
91
+ ]
92
+
93
+ TEMPLATES = [
94
+ {
95
+ # ...
96
+ 'OPTIONS': {
97
+ 'context_processors': [
98
+ # Ensure this is present
99
+ 'django.template.context_processors.request',
100
+ # ...
101
+ ],
102
+ },
103
+ },
104
+ ]
105
+
106
+ # Optional settings (see configuration section for details)
107
+ SESSION_SECURITY_WARN_AFTER = 540 # Warn user after 9 minutes
108
+ SESSION_SECURITY_EXPIRE_AFTER = 600 # Log out after 10 minutes
109
+ SESSION_SECURITY_PASSIVE_URLS = [] # URLs that won’t reset the timer
110
+ SESSION_SECURITY_REDIRECT_TO_LOGOUT = False # Set True for SSO setups
111
+ SESSION_SECURITY_PING_URL = '/session_security/ping/' # Activity endpoint
112
+ SESSION_SECURITY_JS_PATH = 'session_security/script.js' # Override to load custom bundles (tests/coverage)
113
+ ```
114
+
115
+ ```python
116
+ # urls.py
117
+
118
+ from django.urls import include, path
119
+
120
+ urlpatterns = [
121
+ # Add this route to enable the session security endpoints
122
+ path('session_security/', include('session_security.urls')),
123
+ # ...
124
+ ]
125
+ ```
126
+
127
+ ```html
128
+ <!-- base.html (or equivalent) -->
129
+ {% load static %}
130
+ ...
131
+ {% include "session_security/all.html" %}
132
+ <script>
133
+ // optional: disable form discard confirmation dialog
134
+ sessionSecurity.confirmFormDiscard = undefined;
135
+ // optional: register custom activity
136
+ sessionSecurity.activity();
137
+ </script>
138
+ ```
139
+
140
+ ## Single Sign-On (SSO) Considerations
141
+
142
+ When using SSO, the default page reload after timeout may cause automatic re-login if the SSO session remains valid. Set `SESSION_SECURITY_REDIRECT_TO_LOGOUT = True` to explicitly end the app session by redirecting to `LOGOUT_REDIRECT_URL`. Note that this does **not** terminate the SSO provider session; configure a matching timeout on your SSO server for full coverage.
143
+
144
+ ## Development
145
+
146
+ This project uses `uv` for managing the development environment. To set up the development environment, follow these steps:
147
+
148
+ ```console
149
+ # Clone the repository
150
+ $ git clone https://github.com/arrai-innovations/django-session-security-continued.git
151
+ $ cd django-session-security-continued
152
+
153
+ # Ensure a compatible Python (>=3.9) is installed
154
+
155
+ # Install uv if not already installed
156
+ $ pip install --user --upgrade uv
157
+
158
+ # Create and sync the dev environment
159
+ # (default group includes dev dependencies)
160
+ $ uv sync
161
+
162
+ # (Optional) Run Git hooks setup
163
+ $ uv run pre-commit install
164
+
165
+ # Install JS tooling for the client bundle / coverage builds
166
+ $ npm install
167
+ ```
168
+
169
+ ## Testing
170
+
171
+ Chrome is required for the Selenium end-to-end tests (Selenium Manager will download the matching chromedriver automatically). Run the full suite with pytest:
172
+
173
+ ```console
174
+ $ uv run pytest
175
+ ```
176
+
177
+ If Chrome isn’t available (or you only want the fast unit tests), skip the browser suite with `uv run pytest -m "not selenium"`.
178
+
179
+ Add extra breathing room to the Selenium waits (in CI) by exporting `SESSION_SECURITY_TIMEOUT_PADDING` (in seconds). For example, `SESSION_SECURITY_TIMEOUT_PADDING=5 uv run pytest -k selenium` gives each warning/expiry wait up to five additional seconds before failing.
180
+
181
+ ### JavaScript coverage
182
+
183
+ We ship a Vite + Istanbul build that instruments the client bundle and collects coverage from the Selenium run:
184
+
185
+ 1. `npm run build:coverage`
186
+ 2. `SESSION_SECURITY_JS_COVERAGE=1 uv run pytest -k selenium`
187
+ 3. `npm run coverage:report` (writes reports to `coverage-js/` and `lcov.info`)
188
+
189
+ The `SESSION_SECURITY_JS_COVERAGE` flag makes the Django test settings load the instrumented bundle and dumps `window.__coverage__` into `.nyc_output/` after each Selenium test.
190
+
191
+ ## Contributing
192
+
193
+ Contributions are welcome. Please fork the repository and create a pull request with your changes. We reserve the right to review and modify your contributions before merging them into the main branch. By submitting a change you confirm that:
194
+
195
+ - You wrote the code (or have the right to contribute it), and
196
+ - You’re happy for it to be released under this project’s MIT license.
197
+
198
+ [code style: ruff]: https://img.shields.io/badge/code%20style-ruff-000000.svg?style=for-the-badge
199
+ [ruff]: https://docs.astral.sh/ruff/formatter/#style-guide
200
+ [code style: prettier]: https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=for-the-badge
201
+ [prettier]: https://github.com/prettier/prettier
202
+ [python 3.9 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.9.svg
203
+ [python 3.10 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.10.svg
204
+ [python 3.11 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.11.svg
205
+ [python 3.12 status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.12.svg
206
+ [coverage status]: https://docs.arrai.dev/dssc/artifacts/main/python_3.9.coverage.svg
207
+ [ruff status]: https://docs.arrai.dev/dssc/artifacts/main/ruff.svg
208
+ [pipenv]: https://github.com/pypa/pipenv
209
+ [pip-audit status]: https://docs.arrai.dev/dssc/artifacts/main/pip-audit.svg
@@ -0,0 +1,48 @@
1
+ LICENSE
2
+ README.md
3
+ pyproject.toml
4
+ ./session_security/__init__.py
5
+ ./session_security/middleware.py
6
+ ./session_security/models.py
7
+ ./session_security/settings.py
8
+ ./session_security/urls.py
9
+ ./session_security/utils.py
10
+ ./session_security/views.py
11
+ ./session_security/templatetags/__init__.py
12
+ ./session_security/templatetags/session_security_tags.py
13
+ ./session_security/tests/__init__.py
14
+ ./session_security/tests/conftest.py
15
+ ./session_security/tests/test_base.py
16
+ ./session_security/tests/test_middleware.py
17
+ ./session_security/tests/test_script.py
18
+ ./session_security/tests/test_templates.py
19
+ ./session_security/tests/test_views.py
20
+ ./session_security/tests/project/__init__.py
21
+ ./session_security/tests/project/settings.py
22
+ ./session_security/tests/project/urls.py
23
+ ./session_security/tests/project/wsgi.py
24
+ django_session_security_continued.egg-info/PKG-INFO
25
+ django_session_security_continued.egg-info/SOURCES.txt
26
+ django_session_security_continued.egg-info/dependency_links.txt
27
+ django_session_security_continued.egg-info/requires.txt
28
+ django_session_security_continued.egg-info/top_level.txt
29
+ session_security/__init__.py
30
+ session_security/middleware.py
31
+ session_security/models.py
32
+ session_security/settings.py
33
+ session_security/urls.py
34
+ session_security/utils.py
35
+ session_security/views.py
36
+ session_security/templatetags/__init__.py
37
+ session_security/templatetags/session_security_tags.py
38
+ session_security/tests/__init__.py
39
+ session_security/tests/conftest.py
40
+ session_security/tests/test_base.py
41
+ session_security/tests/test_middleware.py
42
+ session_security/tests/test_script.py
43
+ session_security/tests/test_templates.py
44
+ session_security/tests/test_views.py
45
+ session_security/tests/project/__init__.py
46
+ session_security/tests/project/settings.py
47
+ session_security/tests/project/urls.py
48
+ session_security/tests/project/wsgi.py