Package: django-require-login
Django Require LoginForked fromdjango-strongholdRequire login on all your django URLs by defaultSupported VersionsPython 3.10, 3.11, 3.12Django 4.2, 5.0Installation and SetupInstall via pip.pipinstalldjango-require-loginThen add the middleware to your MIDDLEWARE in your Django settings fileMIDDLEWARE=[#..."django_require_login.middleware.LoginRequiredMiddleware",]After adding the middleware, all your Django views will default to login required.If yourLOGIN_URLandLOGOUT_REDIRECT_URLcontain anamed URL patternaddREQUIRE_LOGIN_PUBLIC_NAMED_URLSto your settings file with yourLOGIN_URLandLOGOUT_REDIRECT_URLREQUIRE_LOGIN_PUBLIC_NAMED_URLS=(LOGIN_URL,LOGOUT_REDIRECT_URL)If yourLOGIN_URLandLOGOUT_REDIRECT_URLdon't contain a named URL pattern addREQUIRE_LOGIN_PUBLIC_URLSto your settings file with yourLOGIN_URLandLOGOUT_REDIRECT_URLREQUIRE_LOGIN_PUBLIC_URLS=(LOGIN_URL,LOGOUT_REDIRECT_URL)UsageTo make a view public again you can use the public decorator:For function based viewsfromdjango_require_login.decoratorsimportpublicfromdjango.httpimportHttpResponse@publicdefmy_view(request):returnHttpResponse("Public")For class based views (decorator)fromdjango.utils.decoratorsimportmethod_decoratorfromdjango_require_login.decoratorsimportpublicfromdjango.views.genericimportViewfromdjango.httpimportHttpResponseclassSomeView(View):defget(self,request,*args,**kwargs):returnHttpResponse("Public view")@method_decorator(public)defdispatch(self,*args,**kwargs):returnsuper().dispatch(*args,**kwargs)For class based views (mixin)fromdjango_require_login.mixinsimportPublicViewMixinfromdjango.views.genericimportViewclassSomeView(PublicViewMixin,View):passConfiguration (optional)You can add a tuple of url regexes in your settings file with theREQUIRE_LOGIN_PUBLIC_URLSsetting. Any url that matches against these patterns
will be made public without using the@publicdecorator.REQUIRE_LOGIN_PUBLIC_URLSDefault:REQUIRE_LOGIN_PUBLIC_URLS=()Development DefaultsIfDEBUGis True,REQUIRE_LOGIN_PUBLIC_URLScontains:fromdjango.confimportsettings(r'{}.+$'.format(settings.STATIC_URL),r'{}.+$'.format(settings.MEDIA_URL),)This is additive to your settings to support serving static files and media files from
the development server. It does not replace any settings you may have inREQUIRE_LOGIN_PUBLIC_URLS.Note: Public URL regexes are matched againstHttpRequest.path_info.REQUIRE_LOGIN_PUBLIC_NAMED_URLSYou can add a tuple of url names in your settings file with theREQUIRE_LOGIN_PUBLIC_NAMED_URLSsetting. Names in this setting will be reversed usingdjango.urls.reverseand any url matching the output of the reverse
call will be made public without using the@publicdecorator:Default:REQUIRE_LOGIN_PUBLIC_NAMED_URLS=()REQUIRE_LOGIN_USER_TEST_FUNCOptionally, set REQUIRE_LOGIN_USER_TEST_FUNC to a callable to limit access to users
that pass a custom test. The callback receives aUserobject and should
returnTrueif the user is authorized. This is equivalent to decorating a
view withuser_passes_test.Example:REQUIRE_LOGIN_USER_TEST_FUNC=lambdauser:user.is_staffDefault:REQUIRE_LOGIN_USER_TEST_FUNC=lambdauser:user.is_authenticatedIntegration with Django REST FrameworkDjango REST Framework is not part of Django and uses its own authentication system.
For this reason, you need to make all of your DRF views public and rely on DRF's
authentication system.ExampleAssuming all your DRF views live under/api/you can make them all public using a regex:REQUIRE_LOGIN_PUBLIC_URLS=(r"^/api/.*",)SecurityIf you believe you've found a bug with security implications, please do not disclose this
issue in a public forum.Email us atsupport@laac.devContributeSeeCONTRIBUTING.md