django-pwned-passwords 0.1.0

Documentation

The full documentation is at https://django-pwned-passwords.readthedocs.io.

Requirements

• Django [1.8, 1.11]

• Python 2.7, [3.4, 3.6]

Quickstart

Install django-pwned-passwords:

pip install django-pwned-passwords

Add it to your INSTALLED_APPS:

INSTALLED_APPS = (
    ...
    'django_pwned_passwords',
    ...
)

Add django-pwned-passwords’s PWNEDPasswordValidator:

AUTH_PASSWORD_VALIDATORS = [
    ...
    {
        'NAME': 'django_pwned_passwords.password_validation.PWNEDPasswordValidator'
    }
]

Features

This password validator returns a ValidationError if the PWNED Passwords API detects the password in its data set. Note that the API is heavily rate-limited, so there is a timeout (PWNED_VALIDATOR_TIMEOUT).

If PWNED_VALIDATOR_FAIL_SAFE is True, anything besides an API-identified bad password will pass, including a timeout. If PWNED_VALIDATOR_FAIL_SAFE is False, anything besides a good password will fail and raise a ValidationError.

Settings

Rate Limiting

Requests to the Pwned Passwords API are limited to one per every 1500 milliseconds each from any given IP address (an address may request both APIs within this period). Any request that exceeds the limit will receive an HTTP 429 “Too many requests” response. If PWNED_VALIDATOR_FAIL_SAFE is True, rate limited responses will simply allow the password through. Otherwise, they will fail and the user will not be able to register until the API returns a non-429 status code.

Running Tests

source <YOURVIRTUALENV>/bin/activate
(myenv) $ pip install tox
(myenv) $ tox

Credits

Tools used in rendering this package:

• Cookiecutter

• cookiecutter-djangopackage

History