Visit http://bitbucket.org/akoha/django-digest/ for further information.
This library facilitates the implementation of HTTP Digest Authentication for Django projects.
It supplies a middleware (HttpDigestMiddleware) that may installed to protect access to all URLs, a decorator (@k) that may be applied to selected view functions, and a simple class (HttpDigestAuthenticator) that can be used to implement custom authentication scenarios.
The following settings may be defined in your Django settings file. Sensible defaults are provided as well.
- DIGEST_ENFORCE_NONCE_COUNT (True):
- Whether the nonce-count supplied by the client is required to increase with each request.
- DIGEST_REALM (DJANGO):
- The realm value to use.
- DIGEST_NONCE_TIMEOUT_IN_SECONDS (5*60):
- The maximum time between the generation of a nonce and the initiation of a session with that nonce.
- DIGEST_REQUIRE_AUTHENTICATION (False):
- If True, the middleware will require all requests to be authenticated. Otherwise, the middleware only performs authentication after intercepting a 401/403 response from the view.
- DIGEST_ACCOUNT_BACKEND ('django_digest.backend.db.AccountStorage'):
- A class responsible for managing access to users and their credentials. Must implement:
- get_partial_digest(self, username):
- Returns H(username:realm:password) or None
- get_user(self, username):
- Returns an object representing the specified user, or None. This object will be stored in request.user upon successful authentication.
- DIGEST_NONCE_BACKEND ('django_digest.backend.db.NonceStorage')
- A class responsible for managing session information. Must implement:
- update_existing_nonce(self, user, nonce, nonce_count):
- Called upon successful authentication of the specified user (as returned from the account backend's get_user method) with the specified nonce and nonce_count. If the nonce-count is not being enforced, nonce_count will be None. This method should return True if the nonce is already associated with the specifed user (only) and the nonce_count is greater than all previous nonce-counts for the same nonce (or is None) or False otherwise.
- store_nonce(self, user, nonce, nonce_count):
- Called upon successful authentication of the specified user (as returned from the account backend's get_user method) if update_existing_nonce returns False. If the nonce-count is not being enforced, nonce_count will be None. This method should return True if the nonce is not already associated with any user.