yunojuno / django-perimeter Goto Github PK
View Code? Open in Web Editor NEWSite-wide perimeter access control for Django projects
License: MIT License
Site-wide perimeter access control for Django projects
License: MIT License
# Django Perimeter Perimeter is a Django app that provides middleware that allows you to 'secure the perimeter' of your django site outside of any existing auth process that you have. ## Compatibility **This package now requires Python 3.8+ and Django 3.2+.** For previous versions please refer to the relevant branch. ## Why? Most django sites have some kind of user registration and security model - a login process, decorators to secure certain URLs, user accounts - everything that comes with `django.contrib.auth` and associated apps. Sometimes, however, you want to simply secure the entire site to prevent prying eyes - the classic example being before a site goes live. You want to erect a secure perimeter fence around the entire thing. If you have control over your front-end web server (e.g. Apache, Nginx) then this can be used to do this using their in-built access control features. However, if you are running your app on a hosting platform you may not have admin access to these parts. Even if you do have control over your webserver, you may not want to be re-configuring it every time you want to grant someone access. That's when you need Perimeter. Perimeter provides simple tokenised access control over your entire Django site (everything, including the admin site and login pages). ## How does it work? Once you have installed and enabled Perimeter, everyone requiring access will need an authorisation token (not authentication - there is nothing inherent in Perimeter to prevent people swapping / sharing tokens - that is an accepted use case). Perimeter runs as middleware that will inspect the user's `session` for a token. If they have a valid token, then they continue to use the site uninterrupted. If they do not have a token, or the token is invalid (expired or set to inactive), then they are redirected to the Perimeter 'Gateway', where they must enter a valid token, along with their name and email (for auditing purposes - this is stored in the database). To create a new token you need to head to the admin site, and create a new token under the Perimeter app. If you have `PERIMETER_ENABLED` set to True already you won't be able to access the admin site (as Perimeter covers everything except for the perimeter 'gateway' form), and so there is a management command (`create_access_token`) that you can use to create your first token. (This is analagous to the Django setup process where it prompts you to create a superuser.) Setup ----- 1. Add `"perimeter"` to your installed apps. 2. Add `"perimeter.middleware.PerimeterAccessMiddleware"` to the list of MIDDLEWARE_CLASSES 3. Add the perimeter urls, including the `"perimeter"` namespace. 4. Add `PERIMETER_ENABLED = True` to your settings file. This setting can be used to enable or disable Perimeter in different environments. Settings: .. code:: python PERIMETER_ENABLED = True INSTALLED_APPS = ( ... "perimeter", ... ) # Perimeter's middleware must be after SessionMiddleware as it relies on # request.session MIDDLEWARE_CLASSES = [ ... "django.contrib.sessions.middleware.SessionMiddleware", "perimeter.middleware.PerimeterAccessMiddleware", ... ] Site urls: .. code:: python # in site urls urlpatterns = [ ... # NB you must include the namespace, as it is referenced in the app path("perimeter/", include("perimeter.urls", namespace="perimeter")), ... ] ## Tests The app has a suite of tests, and a ``tox.ini`` file configured to run them when using ``tox`` (recommended).
If a token has expired, it would be useful to be able to extend it through the create_access_token
management command, rather than just blowing up with a duplicate key database error.
Proposed solution is that if you specify a token that already exists, and an expires value, then this should overwrite the existing expiry.
e.g.
# fails if token exists and has expired
python manage.py create_access_token --token foobar
# extends expiry of token by 100 days (from today)
python manage.py create_access_token --token foobar --expires 100
If the perimeter logger isn't setup, the management commands don't output anything, so probably best to use print instead (in this specific case).
Suggestion:
manage.py create_access_token -t <token> -e <delta in days>
I'm not sure it's necessary to print PERIMETER_ENABLED
and PERIMETER_DEFAULT_EXPIRY
immediately after running any Django management command when DEBUG
is True
https://github.com/yunojuno/django-perimeter/blob/master/perimeter/settings.py#L39
When running dumpdata and redirecting stdout + stderr to a file these two PERIMETER lines appear at the top of fixtures.
Sometimes, I need to leave a site behind perimeter, but then get messed up when a third-party needs to contact it (eg am developing a webhook integration).
It'd be handy if one could whitelist one/all of these:
Accepts
header of application/json
and a view/resource which returns that same content type. This may be a nightmare to make secure, but would allow machine users to still poke a site that's behind a no-humans-yet-please perimeter)At the moment django-perimeter wraps all urls.
It would be useful allowing to specify a list of endpoints/regexes that bypass perimeter.
It's bare HTML at the moment, and it looks awful. Just a little bit of inline CSS would lift it.
eg
GET http://example.com/path/to/thing/?token=foobarbaz
if that gets intercepted by Perimiter, the redirect url becomes
/perimeter/gateway/?next=/path/to/thing
with no querystring on there.
I know that in practical terms it's not a big deal, but nice to sort out
token = models.CharField(max_length=10, unique=True)
combined with expiry times makes it a little tricky to create human-memorable tokens. A bit more breathing space would be useful.
In some places we need to be able to programmatically bypass the perimeter - e.g. when running automated tests, or certain remote API calls. Adding basic auth would enable this.
NB Basic Auth transmits credentials in plain text, so should only be used with HTTPS, and even then should not be used to secure anything that requires strong security. It's for basic pre-launch perimeters only.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.