1. akoha
  2. django-digest

Overview

Visit http://bitbucket.org/akoha/django-digest/ for further information.

This library facilitates the implementation of HTTP Digest Authentication for Django projects.

It supplies a middleware (HttpDigestMiddleware) that may installed to protect access to all URLs, a decorator (@httpdigest) that may be applied to selected view functions, and a simple class (HttpDigestAuthenticator) that can be used to implement custom authentication scenarios.

The following settings may be defined in your Django settings file. Sensible defaults are provided as well.

DIGEST_ENFORCE_NONCE_COUNT (True):
Whether the nonce-count supplied by the client is required to increase with each request.
DIGEST_REALM (DJANGO):
The realm value to use.
DIGEST_NONCE_TIMEOUT_IN_SECONDS (5*60):
The maximum time between the generation of a nonce and the initiation of a session with that nonce.
DIGEST_REQUIRE_AUTHENTICATION (False):
If True, the middleware will require all requests to be authenticated. Otherwise, the middleware only performs authentication after intercepting a 401/403 response from the view.
DIGEST_ACCOUNT_BACKEND ('django_digest.backend.db.AccountStorage'):
A class responsible for managing access to users and their credentials. Must implement:
  • get_partial_digest(self, username):

    Returns H(username:realm:password) or None

  • get_user(self, username):

    Returns an object representing the specified user, or None. This object will be stored in request.user upon successful authentication.

DIGEST_NONCE_BACKEND ('django_digest.backend.db.NonceStorage')
A class responsible for managing session information. Must implement:
  • update_existing_nonce(self, user, nonce, nonce_count):

    Called upon successful authentication of the specified user (as returned from the account backend's get_user method) with the specified nonce and nonce_count. If the nonce-count is not being enforced, nonce_count will be None. This method should return True if the nonce is already associated with the specifed user (only) and the nonce_count is greater than all previous nonce-counts for the same nonce (or is None) or False otherwise.

  • store_nonce(self, user, nonce, nonce_count):

    Called upon successful authentication of the specified user (as returned from the account backend's get_user method) if update_existing_nonce returns False. If the nonce-count is not being enforced, nonce_count will be None. This method should return True if the nonce is not already associated with any user.