https://github.com/orsinium-archive/django-bruteforce-protection
Bruteforce protection for Django projects based on Redis. Simple, powerful, extendable.
https://github.com/orsinium-archive/django-bruteforce-protection
bruteforce bruteforce-protection django login protection redis security
Last synced: 7 months ago
JSON representation
Bruteforce protection for Django projects based on Redis. Simple, powerful, extendable.
- Host: GitHub
- URL: https://github.com/orsinium-archive/django-bruteforce-protection
- Owner: orsinium-archive
- License: lgpl-3.0
- Archived: true
- Created: 2018-03-01T11:52:18.000Z (over 7 years ago)
- Default Branch: master
- Last Pushed: 2018-05-07T06:02:09.000Z (over 7 years ago)
- Last Synced: 2025-03-12T08:38:55.550Z (7 months ago)
- Topics: bruteforce, bruteforce-protection, django, login, protection, redis, security
- Language: Python
- Homepage:
- Size: 128 KB
- Stars: 105
- Watchers: 3
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# DjBrut
[](https://travis-ci.org/orsinium/django-bruteforce-protection) [](https://pypi.python.org/pypi/djbrut) [](https://pypi.python.org/pypi/djbrut) [](https://github.com/orsinium/django-bruteforce-protection) [](LICENSE)
DjBrut -- simple brutforce protection for Django project.
Default checkers:
* Max requests for IP.
* Max requests for user.
* Max requests for one CSRF-token (stupid but effective).
* Max requests frequency limitation.
DjBrut use Redis as storage for all counters.
## Installation
```
pip install djbrut
```
## Usage
```python
from django.http import HttpResponse
from djbrut import Attempt
def some_view(request):
attempt = Attempt('some rule type name', request)
# check
if not attempt.check():
# error
return HttpResponse(attempt.error)
# success
...
```
You can see [example project](example/) for more details.
## Configuring
Just set up rules:
```python
BRUTEFORCE_LIMITS = {
'default': Rule(
user=100, # max requests for one user by BRUTEFORCE_TIMELIMIT
ip=300, # max requests for one IP by BRUTEFORCE_TIMELIMIT
csrf=50, # max requests with one CSRF token by BRUTEFORCE_TIMELIMIT
freq=0, # max request frequency for client [seconds]
),
'some rule type name': Rule(
user=100, # max requests for one user by BRUTEFORCE_TIMELIMIT
ip=300, # max requests for one IP by BRUTEFORCE_TIMELIMIT
csrf=50, # max requests with one CSRF token by BRUTEFORCE_TIMELIMIT
freq=0, # max request frequency for client [seconds]
),
}
```
`Attempt` get rule type name as first arg. If rule type name not found in keys of BRUTEFORCE_LIMITS, 'default' will be used. If you don't set default rule then passed rule type must be exists in BRUTEFORCE_LIMITS keys.
`BRUTEFORCE_TIMELIMIT` -- time to live for all attempts counters.
You can see [default settings](djbrut/default_settings.py) for more params such as custom error message.
## Advanced usage. Create custom checker
If you want use custom checker:
1. Create custom checker [like built-in](https://github.com/orsinium/django-bruteforce-protection/blob/1.0.0/djbrut/checkers.py#L121).
2. Create new [Rules](djbrut/utils.py) with your checker attribute.
3. Add your checker to [BRUTEFORCE_CHECKERS](https://github.com/orsinium/django-bruteforce-protection/blob/1.0.0/djbrut/default_settings.py#L41)