Package: django-lockout
django-lockoutis a cache-based Django app that locks out users after too
many failed login attempts. Becausedjango-lockouttracks login attempts
in your site’s cache, it is fast and lightweight. It is intended for Django
sites where protection against brute force attacks is desired with no
additional database overhead.django-lockoutwrapsdjango.contrib.auth.authenticateand raiseslockout.LockedOutwhen too many login attempts occur. Your views are
responsible for catching and handlingLockedOuthowever you deem
appropriate.django-lockout’s middleware class stores the request object
in the thread local namespace to give the wrappedauth.authenticatefunction access to it.Login attempts can be tracked by IP only or by IP plus user-agent.Requirementsdjango-lockoutis designed for Django 1.3. It also works with Django 1.0,
1.1, and 1.2, with the exception of the test suite (which relies ondjango.test.client.RequestFactory). If you usedjango-lockoutwith an
earlier version of Django than 1.3, you should not add'lockout'to yourINSTALLED_APPS.django-lockoutrequires that you have enabled a cache for your site.InstallationYou can installdjango-lockoutwith:pip install django-lockoutor:easy_install django-lockoutAdd'lockout.middleware.LockoutMiddleware'to yourMIDDLEWARE_CLASSES.
It should come before Django’sAuthenticationMiddleware:MIDDLEWARE_CLASSES = [
    'lockout.middleware.LockoutMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    ...
    ]Adding'lockout'to yourINSTALLED_APPSis only required if you want to
rundjango-lockout’s test suite.UsageBelow is an example of how you might usedjango-lockout:try:
    user = auth.authenticate(username=username, password=password)
except LockedOut:
    messages.warning(request, 'Your account has been locked out because of too many failed login attempts.')If you need to clear the record of failed attempts for an IP or IP plus
user-agent, calllockout.reset_attempts, passing therequestfor that
IP or IP plus user-agent:reset_attempts(request)SettingsLOCKOUT_MAX_ATTEMPTSThe maximum number of login attempts before the IP or IP plus user-agent
is locked out. Default:5.LOCKOUT_TIMEThe number of seconds the IP or IP plus user-agent should be locked out.
Default:600(10 minutes).LOCKOUT_ENFORCEMENT_WINDOWThe number of seconds before the failed login attempts are reset and the
IP or IP plus user-agent gets a fresh start. Default:300(5 minutes).LOCKOUT_ENFORCEMENT_WINDOWaffects failed login attempts up to the max
allowed, whileLOCKOUT_TIMEtakes effect when the max attempts is
reached. For example, with aLOCKOUT_ENFORCEMENT_WINDOWof 5 minutes,
suppose a user has a failed login attempt, followed by another failed
login attempt 3 minutes later. Both attempts will count toward the
maximum. However, if the 5-minute mark (from the first failed attempt) is
reached with fewer than the max allowed attempts, the failures will expire
and the user will once again be allowed the maximum attempts. If the user
exceeds the max within theLOCKOUT_ENFORCEMENT_WINDOW, the user will
be locked out forLOCKOUT_TIMEseconds.LOCKOUT_USE_USER_AGENTWhether to track failed login attempts by IP plus user-agent, instead of
by IP only. Default:False.LOCKOUT_CACHE_PREFIXThe prefix for cache keys generated bydjango-lockout. Default:'lockout'.