Registry / auth-security / django-defender

django-defender

library0.9.8pypypi✓ verified 84d ago

Redis-based Django app that locks out users after too many failed login attempts. Current version 0.9.8, requires Python ~=3.7 and Django >=3.2 (or 4.x). Maintained by Jazzband. Release cadence: irregular, last release Jan 2024.

auth-security database web-framework

pip install django-defender

github ↗package ↗

INSTALL

IMPORT

SIG · DJANGO-DEFENDER

django-defender

auth-securitypythonv0.9.8

Install

3.7s avg

Import

—

Disk

71MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.9.8 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 71.5MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 3.7s · import 0.000s · 72MB

71MB installed

● package 71MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

VERSION

✓ from defender import VERSION

✗ from defender.decorators import watch_login

Basic setup: add 'defender' to INSTALLED_APPS, configure REDIS_URL, add FailedLoginMiddleware, include defender URLs.

INSTALLED_APPS = [ 'django.contrib.admin', 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.messages', 'django.contrib.staticfiles', 'defender', ] # settings.py DEFENDER_REDIS_URL = os.environ.get('DEFENDER_REDIS_URL', 'redis://localhost:6379/0') MIDDLEWARE = [ 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'defender.middleware.FailedLoginMiddleware', ] # Add to urlpatterns in urls.py from defender import urls as defender_urls urlpatterns += [ path('defender/', include(defender_urls)), ] # run migrations # python manage.py migrate defender

Debug

Known issues

breakingdjango-defender requires a running Redis server. Without it, login attempts will fail silently or raise a ConnectionError.

fix

Ensure Redis is running and DEFENDER_REDIS_URL is correctly configured.

affects: all

gotchaThe default COOLOFF_TIME is 300 seconds (5 minutes). After that, the counter resets. This can be confusing if you expect lockout to persist longer.

fix

Set DEFENDER_COOLOFF_TIME (or DEFENDER_ATTEMPT_COOLOFF_TIME / DEFENDER_LOCKOUT_COOLOFF_TIME from v0.9.6) to your desired value in seconds.

affects: all

gotchawatch_login decorator expects the request object to have a user attribute. If used on a custom login view that doesn't set request.user, it will raise AttributeError.

fix

Ensure the view sets request.user before calling watch_login, or use the middleware instead.

affects: all

deprecatedPython 3.6 and Django 3.1 support dropped in v0.9.2. Django 2.2 dropped in v0.9.3.

fix

Upgrade to Python >=3.7 and Django >=3.2.

affects: >=0.9.2

Upgrade

Version history

0.9.8latest on PyPI · released Feb 15, 2024

Audit

Dependencies

redisrequiredRequired; used for tracking failed attempts and lockout state.

djangorequiredRequired; Django web framework.

Agent activity

13 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/kencochrane/django-defender ↗

packagehttps://pypi.org/project/django-defender/ ↗