Package: django-authlink
Django Authlinkdjango-authlinkdjango-authlinkis a Django app that faciliates authentication using magic links. This is perfect for allowing a mobile-app to authenticate for webviews, but could be used for myriad other cases where you need to pre-authenticate the user.Convenient APIs for Django Rest Framework are included.Installationpipinstalldjango-authlinkAddauthlinkto your INSTALLED_APPS setting and then exposeauthlink.api.rest_framework.views.AuthLinkCreateViewin your API, andauthlink.views.AuthLinkViewin your web application.The exact URLs you use is up to you, but here is an example:fromdjango.contribimportadminfromdjango.urlsimportpathfromauthlink.viewsimportAuthLinkViewfromauthlink.api.rest_framework.viewsimportAuthLinkCreateViewurlpatterns=[path('api/authlink',AuthLinkCreateView.as_view()),path(r'authlink/(?P<key>[\w]+)$',AuthLinkView.as_view()),]Now you should setAUTHLINK_URL_TEMPLATEto match the URL structure in your web application:AUTHLINK_URL_TEMPLATE="/authlink/{key}"This will allow the API to build the correct location for mobile apps to load into web views.UsageWhen your mobile app needs to load an authenticated webview, it should hit the API to get an authlink:POST /api/authlink{"url": "/some/whitelisted/path/in/your/webapp"}Assuming the user was currently authenticated, this will return:HTTP 201 CreatedContent-Type: application/jsonLocation: https://authlink/k6s1fhv3a6e99liamatxqrn1m6nynn1krbtzw47wxckhyiahwohp4f7bb8del6hf{"url": "/some/whitelisted/path/in/your/webapp"}To load the authenticated webview, your mobile app can now open its particular webview class using theLocationin the response above, and if the token is valid the target URL will load authenticated.SecurityWhen you share an authlink, you are essentially providing unfettered authenticated access to a user's account.django-authlinkattempts to reduce the chances of having one of these links somehow fall into the hands of an attacker and give them access to another user's account using several measures.A tight expiry window; by default authlinks are only valid for 60 seconds. You can reduce this to further close the window of validity and so vulnerability.Whitelisting of URLs; you need to specify what web-app URLs you want to allow authlinks to be created for. Note that once the user is authenticated, they can browse around, so this is not going to actually limit them to that URL.Matching of IP addresses; the IP address used when creating the authlink via the API must match the IP address of the request to use the authlink in the web application.Depsite these measures, there is still an undeniable security risk to using this authentication method. You need to weigh the pros and cons for your particular use case and make your own decision there whether this makes sense for your project.ConfigurationAUTHLINK_URL_TEMPLATEDefault: "/authlink/{key}"Allows variation of the redirect URLs that the authlink create API produces.AUTHLINK_URL_WHITELISTDefault: []A list of URL names that you want to restrict authlinks being created for.AUTHLINK_ADAPTER_CLASSDefault: "authlink.adapter.DefaultAuthLinkAdapter"You can subclass the adapter and add any customisations you want to general authlink behaviour.AUTHLINK_TTL_SECONDSDefault: 60Allows increasing or decreasing the period of validity for an authlink.Contributedjango-authlinksupports a variety of Python and Django versions. It's best if you test each one of these before committing. OurCircle CI Integrationwill test these when you push but knowing before you commit prevents from having to do a lot of extra commits to get the build to pass.Environment SetupIn order to easily test on all these Pythons and run the exact same thing that CI will execute you'll want to setuppyenvand install the Python versions outlined intox.ini.If you are on Mac OS X, it's recommended you usebrew. After installingbrewrun:brewinstallpyenvpyenv-virtualenvpyenv-virtualenvwrapperNext, install the various python versions we want to test against and create a virtualenv specifically fordjango-authlink:pyenvinstall3.6.10
pyenvinstall3.7.6
pyenvinstall3.8.1
pyenvvirtualenv3.8.1authlink
pyenvactivateauthlink
pipinstalldetox
pyenvshellauthlink3.6.103.7.6Now ensure theauthlinkvirtualenv is activated, make the other python versions also on our path, and run the tests!pyenvshellauthlink3.6.103.7.6
detoxThis will execute the test environments in parallel as defined in thetox.ini.