Skip to main content

Complete Two-Factor Authentication for Django

Project description

Build Status Test Coverage PyPI

Complete Two-Factor Authentication for Django. Built on top of the one-time password framework django-otp and Django’s built-in authentication framework django.contrib.auth for providing the easiest integration into most Django projects. Inspired by the user experience of Google’s Two-Step Authentication, allowing users to authenticate through call, text messages (SMS), by using a token generator app like Google Authenticator or a YubiKey hardware token generator (optional).

I would love to hear your feedback on this package. If you run into problems, please file an issue on GitHub, or contribute to the project by forking the repository and sending some pull requests. The package is translated into English, Dutch and other languages. Please contribute your own language using Transifex.

Test drive this app through the online example app, hosted by Heroku. It demos most features except the Twilio integration. The example also includes django-user-sessions for providing Django sessions with a foreign key to the user. Although the package is optional, it improves account security control over django.contrib.sessions.

Compatible with all supported Django (LTS) versions. At the moment of writing that’s including 1.7 and 1.8 on Python 2.7, 3.2, 3.3 and 3.4. Documentation is available at readthedocs.org.

Installation

Installation with pip:

$ pip install django-two-factor-auth

On Django 1.8, also install django-formtools:

$ pip install django-formtools

Setup

Add the following apps to the INSTALLED_APPS:

INSTALLED_APPS = (
    ...
    'django_otp',
    'django_otp.plugins.otp_static',
    'django_otp.plugins.otp_totp',
    'two_factor',
)

Add django_otp.middleware.OTPMiddleware to MIDDLEWARE_CLASSES. It must be installed after AuthenticationMiddleware:

MIDDLEWARE_CLASSES = [
    'django.middleware.common.CommonMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django_otp.middleware.OTPMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
]

Configure a few urls in settings.py:

from django.core.urlresolvers import reverse_lazy
LOGIN_URL = reverse_lazy('two_factor:login')

Add the url routes to the project in urls.py:

urlpatterns = [
    url(r'', include('two_factor.urls', 'two_factor')),
]

Be sure to remove any other login routes, otherwise the two-factor authentication might be circumvented. The admin interface should be automatically patched to use the new login method.

Support for YubiKey is disabled by default, but enabling is easy. Please refer to the documentation for instructions.

Contribute

  • Submit issues to the issue tracker on Github.

  • Fork the source code at Github.

  • Write some code and make sure it is covered with unit tests.

  • Send a pull request with your changes.

  • Provide a translation using Transifex.

Running tests

This project aims for full code-coverage, this means that your code should be well-tested. Also test branches for hardened code. You can run the full test suite with:

make test

Or run a specific test with:

make test TARGET=tests.tests.TwilioGatewayTest

For Python compatibility, tox is used. You can run the full test suite with:

tox

Releasing

The following actions are required to push a new version:

python example/manage.py makemigrations two_factor
git commit -am "Added migrations"

bumpversion [major|minor|patch]
git commit -am "Released [version]"
git tag [version]
python setup.py sdist bdist_wheel upload

See Also

Have a look at django-user-sessions for Django sessions with a foreign key to the user. This package is also included in the online example app.

License

The project is licensed under the MIT license.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

django-two-factor-auth-1.3.0.tar.gz (60.9 kB view details)

Uploaded Source

Built Distribution

django_two_factor_auth-1.3.0-py2.py3-none-any.whl (139.8 kB view details)

Uploaded Python 2 Python 3

File details

Details for the file django-two-factor-auth-1.3.0.tar.gz.

File metadata

File hashes

Hashes for django-two-factor-auth-1.3.0.tar.gz
Algorithm Hash digest
SHA256 42d407ff677e6d7e5f90f562fb10f538138a8b83fc01298d386cd1fb827fe259
MD5 17292b41b3a2f5ee64acadbd858ae21e
BLAKE2b-256 1fec0e95b445009520498ca6c48ecb45f54e0e0fc96c82cbd9d0c32c3ad8170c

See more details on using hashes here.

Provenance

File details

Details for the file django_two_factor_auth-1.3.0-py2.py3-none-any.whl.

File metadata

File hashes

Hashes for django_two_factor_auth-1.3.0-py2.py3-none-any.whl
Algorithm Hash digest
SHA256 e57912ba32f2834cfa99a957eab13e0db6d6d84f7b8ba20c71e86b349bca34d3
MD5 c7aacfea9ae68389863eb76295e88bd6
BLAKE2b-256 be0068c14e68c86474a313621024770e3a87f31cfcd45ca40240c96a6fb62ed8

See more details on using hashes here.

Provenance

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page