Encrypts information in urls, such as login credentials. Useful if you want to send a user a link that logs the user in without leaking their login credentials.
Project description
django-urlcrypt encrypts information in urls, such as login credentials.
For example, assume I have url patterns that looks like this:
urlpatterns = patterns('',
url(r'^inbox/$', 'message_inbox', name='message_inbox'),
(r'^r/', include('urlcrypt.urls')),
)
I can use django-urlcrypt to generate a url for a user that looks like:
http://www.mydomain.com/r/TkNJBkNFAghDWkdFGPUAQEfcDUJfEBIREgEUFl1BQ18IQkdDUUcPSh4ADAYAWhYKHh8KHBsHEw
and will automatically log that person in and redirects them to /inbox/.
Installation
easy_install django-urlcrypt or pip install django-urlcrypt
Add urlcrypt to your INSTALLED_APPS
In settings.py add 'urlcrypt.auth_backends.UrlCryptBackend' to AUTHENTICATION_BACKENDS
In urls.py add:
(r'^r/', include('urlcrypt.urls')),(recommended) If you wish to use RSA encryption on your tokens, generate a private key with ssh-keygen -t rsa -f <path to private key> if you don’t already have one, and then set the path to the private key as URLCRYPT_PRIVATE_KEY_PATH. RSA encryption makes the token much longer but is more secure. The pycrypto library is required.
Usage
In a view:
from django.core.urlresolvers import reverse
from urlcrypt import lib as urlcrypt
token = urlcrypt.generate_login_token(user, reverse('message_inbox'))
encoded_url = reverse('urlcrypt_redirect', args=(token,))
# yours will look slightly different because you have a different SECRET_KEY, but approximately
# encoded_url == /r/TkNJBkNFAghDWkdFGPUAQEfcDUJfEBIREgEUFl1BQ18IQkdDUUcPSh4ADAYAWhYKHh8KHBsHEw
In a template:
{% load urlcrypt_tags %}
<a href="{% encoded_url user message_inbox %}">click me to log in as {{user.username}} and go to {% url message_inbox %}</a>
Advanced lib usage:
from urlcrypt import lib as urlcrypt
message = {
'url': u'/users/following/',
'user_id': '12345'
}
token = urlcrypt.encode_token((message['user_id'], message['url']))
decoded_message = urlcrypt.decode_token(token, ('user_id', 'url', 'timestamp'))
>>> print token
TkNJBkNFAghDWkdFGPUAQEfcDUJfEBIREgEUFl1BQ18IQkdDUUcPSh4ADAYAWhYKHh8KHBsHEw
>>> print decoded_message
{'url': '/users/following/', 'user_id': '12345'}
Settings
URLCRYPT_LOGIN_URL
default: LOGIN_URL
If urlcrypt authentication fails, redirects to URLCRYPT_LOGIN_URL.
URLCRYPT_RATE_LIMIT
default: 60
The number of urlcrypt requests a unique visitor is allowed to make per minute.
URLCRYPT_PRIVATE_KEY_PATH
default: None
The path to the RSA private key file in PEM format. If None, RSA encryption will not be used.
RUNNING_TESTS
default: False
Set RUNNING_TESTS to True when running the urlcrypt tests.
