Registry / web-framework / django-session-security

django-session-security

library2.6.8pypypi✓ verified 86d ago

Provides client- and server-side session timeout enforcement with configurable warnings. v2.6.8 requires Python >=3.10 and Django >=3.2. Maintenance branch with infrequent releases.

web-framework auth-security

pip install django-session-security

github ↗package ↗

INSTALL

IMPORT

SIG · DJANGO-SESSION-SEC

django-session-security

web-frameworkpythonv2.6.8

Install

3.5s avg

Import

699ms

Disk

66MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v2.6.8 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.598s · 66.9MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 3.5s · import 0.520s · 67MB

66MB installed

● package 66MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

SessionSecurityMiddleware

✓ from session_security.middleware import SessionSecurityMiddleware

✗ from session_security import SessionSecurityMiddleware

Middleware is in the middleware submodule, not the package root.

SessionSecurityMixin

✓ from session_security.views import SessionSecurityMixin

Add app and middleware to settings. Run manage.py migrate if using the model backend.

INSTALLED_APPS = [ ... 'session_security', ] MIDDLEWARE = [ 'session_security.middleware.SessionSecurityMiddleware', ... ] # Optional settings SESSION_SECURITY_EXPIRE_AFTER = 600 # seconds SESSION_SECURITY_WARN_AFTER = 540 # seconds SESSION_SECURITY_PASSIVE_URLS = []

Debug

Known issues

breakingRemoved support for the legacy `SESSION_EXPIRE_AT_BROWSER_CLOSE` setting. Session expiry is now controlled solely by `SESSION_SECURITY_EXPIRE_AFTER`.

fix

Use `SESSION_SECURITY_EXPIRE_AFTER` instead of legacy setting.

affects: >=2.6.0

deprecatedThe `session_security.decorators` module (e.g., `@session_security_disabled`) is deprecated and will be removed in v3.0.

fix

Use mixin-based approach: `from session_security.views import SessionSecurityMixin`.

affects: >=2.6.0

gotchaIf using Django's `SILENCED_SYSTEM_CHECKS`, adding `'session_security.W001'` will suppress the middleware position check — but doing so without proper middleware order will cause session expiry to not trigger.

fix

Ensure `SessionSecurityMiddleware` is placed after `AuthenticationMiddleware` and before `SessionMiddleware`.

affects: all

Errors

Common errors & fixes

django.core.exceptions.ImproperlyConfigured: The SESSION_SECURITY_EXPIRE_AFTER setting must be an integer.

The setting is missing or set to a non-int value.

fix

Add `SESSION_SECURITY_EXPIRE_AFTER = 600` (or another integer) in settings.

ImportError: cannot import name 'SessionSecurityMiddleware' from 'session_security'

Wrong import path.

fix

Use `from session_security.middleware import SessionSecurityMiddleware`.

django.core.checks.W001: session_security.SessionSecurityMiddleware not found in MIDDLEWARE in the correct position.

Middleware is missing or in wrong order.

fix

Add `'session_security.middleware.SessionSecurityMiddleware'` after `AuthenticationMiddleware` and before `SessionMiddleware`.

Upgrade

Version history

2.6.8latest on PyPI · released Apr 24, 2026

Audit

Dependencies

DjangorequiredRequired, version >=3.2

Agent activity

25 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/yourlabs/django-session-security ↗

packagehttps://pypi.org/project/django-session-security/ ↗