{"id":13491088,"url":"https://github.com/yourlabs/django-session-security","last_synced_at":"2025-05-15T19:03:39.407Z","repository":{"id":3314576,"uuid":"4357216","full_name":"yourlabs/django-session-security","owner":"yourlabs","description":"A little javascript and middleware work together to ensure that the user was active during the past X minutes in any tab he has open. Otherwise, display a warning leaving a couple of minutes to show any kind of activity like moving the mouse. Otherwise, logout the user.","archived":false,"fork":false,"pushed_at":"2024-07-10T08:03:02.000Z","size":415,"stargazers_count":310,"open_issues_count":30,"forks_count":140,"subscribers_count":26,"default_branch":"master","last_synced_at":"2025-03-17T12:36:49.413Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"http://django-session-security.rtfd.org","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/yourlabs.png","metadata":{"files":{"readme":"README.rst","changelog":"CHANGELOG","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":"AUTHORS","dei":null,"publiccode":null,"codemeta":null}},"created_at":"2012-05-17T10:40:37.000Z","updated_at":"2025-01-20T10:55:10.000Z","dependencies_parsed_at":"2025-01-25T04:34:02.686Z","dependency_job_id":"bb18b461-b905-4929-b92a-bd46f3987950","html_url":"https://github.com/yourlabs/django-session-security","commit_stats":{"total_commits":271,"total_committers":50,"mean_commits":5.42,"dds":0.4354243542435424,"last_synced_commit":"266cc7c6ed299bc4c51929aef9c434b15289bc64"},"previous_names":[],"tags_count":43,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yourlabs%2Fdjango-session-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yourlabs%2Fdjango-session-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yourlabs%2Fdjango-session-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yourlabs%2Fdjango-session-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/yourlabs","download_url":"https://codeload.github.com/yourlabs/django-session-security/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247744335,"owners_count":20988783,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T19:00:53.443Z","updated_at":"2025-04-07T23:11:02.906Z","avatar_url":"https://github.com/yourlabs.png","language":"Python","funding_links":[],"categories":["Libs","Python"],"sub_categories":["Session management"],"readme":".. image:: https://img.shields.io/pypi/v/django-session-security.svg\n        :target: https://pypi.python.org/pypi/django-session-security\n        :alt: Latest version\n.. image:: https://github.com/yourlabs/django-session-security/actions/workflows/tests.yml/badge.svg\n        :target: https://github.com/yourlabs/django-session-security/actions\n        :alt: Unit tests\n.. image:: https://readthedocs.org/projects/django-session-security/badge/?version=latest\n        :target: https://django-session-security.readthedocs.io/en/latest/?badge=latest\n        :alt: Documentation Status\n.. image:: https://img.shields.io/pypi/pyversions/django-session-security.svg?style=flat-square\n        :target: https://pypi.python.org/pypi/django-session-security/\n        :alt: Supported python versions\n.. image:: https://img.shields.io/pypi/l/django-session-security.svg?style=flat-square\n        :target: https://github.com/yourlabs/django-session-security/blob/master/LICENSE\n        :alt: License\n\nSupported python versions\n    Python 3.8, 3.9, 3.10\nSupported django versions\n    Django 1.8, 1.9, 1.10, 1.11, 2.2, 3.2, 4.0, 4.1\n\nA little javascript and middleware work together to ensure that the user was\nactive during the past X minutes in any tab he has open.\nOtherwise, display a warning leaving a couple of minutes to show any kind of\nactivity like moving the mouse. Otherwise, logout the user.\n\nDocumentation\n-------------\nhttps://django-session-security.readthedocs.io/\n\nAbout\n-----\n\nThis app provides a mechanism to logout inactive authenticated users. An\ninactive browser should be logged out automatically if the user left his\nworkstation, to protect sensitive data that may be displayed in the browser. It\nmay be useful for CRMs, intranets, and such projects.\n\nFor example, if the user leaves for a coffee break, this app can force logout\nafter say 5 minutes of inactivity.\n\nWhy not just set the session to expire after X minutes ?\n--------------------------------------------------------\n\nOr \"Why does this app even exist\" ? Here are the reasons:\n\n- if the user session expires before the user is done reading a page: he will\n  have to login again.\n- if the user session expires before the user is done filling a form: his work\n  will be lost, and he will have to login again, and probably yell at you, dear\n  django dev ... at least I know I would !\n\nThis app allows to short circuit those limitations in session expiry.\n\nHow does it work ?\n------------------\n\nWhen the user loads a page, SessionSecurity middleware will set the last\nactivity to now. The last activity is stored as datetime\nin ``request.session['_session_security']``. To avoid having the middleware\nupdate that last activity datetime for a URL, add the url to\n``settings.SESSION_SECURITY_PASSIVE_URLS``.\n\nWhen the user moves mouse, click, scroll or press a key, SessionSecurity will\nsave the DateTime as a JavaScript attribute. It will send the number of seconds\nsince when the last user activity was recorded to PingView, next time it should\nping.\n\nFirst, a warning should be shown after ``settings.SESSION_SECURITY_WARN_AFTER``\nseconds. The warning displays a text like \"Your session is about to expire,\nmove the mouse to extend it\".\n\nBefore displaying this warning, SessionSecurity will upload the time since the\nlast client-side activity was recorded. The middleware will take it if it is\nshorter than what it already has - ie. another more recent activity was\ndetected in another browser tab. The PingView will respond with the number of\nseconds since the last activity - all browser tab included.\n\nIf there was no other, more recent, activity recorded by the server: it will\nshow the warning. Otherwise it will update the last activity in javascript from\nthe PingView response.\n\nSame goes to expire after ``settings.SESSION_SECURITY_EXPIRE_AFTER`` seconds.\nJavascript will first make an ajax request to PingView to ensure that another\nmore recent activity was not detected anywhere else - in any other browser tab.\n\nNote to SSO (single sign-on) users\n----------------------------------\n\nBy default, this package reloads the current page after timeout, prompting a\nuser to log back into the application to resume where they left off.  When\nusing SSO, however, this can produce confusing behavior.  For example, if the\nSSO session is still alive, a user may by automatically logged back into the\napplication.\n\nTo avoid this behavior, some users (c.f. issue #93) want the timeout to end the\nSSO login as well.  On a properly configured application, this will happen if\nyou set ``settings.SESSION_SECURITY_REDIRECT_TO_LOGOUT`` to `True`.  When the\ntimeout is reached, users will be redirected to the application's logout page\nconfigured at ``settings.LOGOUT_REDIRECT_URL``.\n\n**Please note that this is not an adequate security model.  If a user closes\nthe browser page before logging out, this setting will have no effect on the\nSSO session.**  At minimum, a similar timeout should be added to the SSO server\nfor users on \"public machines\" to ensure the SSO session is also timed out.\n\nRequirements\n------------\n\n- Python 3.8+\n- jQuery 1.7+\n- Django 3.2 to 4.0\n- django.contrib.staticfiles or #YoYo\n\nResources\n---------\n\nYou could subscribe to the mailing list ask questions or just be informed of\npackage updates.\n\n- `Git graciously hosted\n  \u003chttps://github.com/yourlabs/django-session-security/\u003e`_ by `GitHub\n  \u003chttp://github.com\u003e`_,\n- `Documentation graciously hosted\n  \u003chttps://django-session-security.readthedocs.io/\u003e`_ by `Read the Docs\n  \u003chttps://readthedocs.io/\u003e`_,\n- `Package graciously hosted\n  \u003chttps://pypi.python.org/pypi/django-session-security/\u003e`_ by `PyPi\n  \u003chttps://pypi.python.org/pypi\u003e`_,\n- `Mailing list graciously hosted\n  \u003chttp://groups.google.com/group/yourlabs\u003e`_ by `Google\n  \u003chttp://groups.google.com\u003e`_\n- For **Security** issues, please contact yourlabs-security@googlegroups.com\n- `Continuous integration graciously hosted\n  \u003chttps://github.com/yourlabs/django-session-security/actions\u003e`_ by `GitHub\n  \u003chttps://github.com\u003e`_\n- `Continuous integration historically hosted\n  \u003chttp://travis-ci.org/yourlabs/django-session-security\u003e`_ by `Travis-ci\n  \u003chttp://travis-ci.org\u003e`_\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyourlabs%2Fdjango-session-security","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fyourlabs%2Fdjango-session-security","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyourlabs%2Fdjango-session-security/lists"}