Package: django-secure-js-login
JavaScript Challenge-handshake authentication django app.travis-ci.org/jedie/django-secure-js-logincoveralls.io/r/jedie/django-secure-js-loginFirst:
The Secure-JS-Login is not a simple“send username + PBKDF2-SHA(password)”It is more aChallenge-handshake authentication protocol!TODO:fix “next_url” and all links in example projectThe procedure:Save a new user password:client browser / JavaScript part:#. user input a passwordinit_pbkdf2_salt = SHA1(random data)pbkdf2_hash =pbkdf2("PlainPassword", salt=init_pbkdf2_salt)Client sendinit_pbkdf2_saltandpbkdf2_hashto the serverServer part:Server splitpbkdf2_hashinto:first_pbkdf2_partandsecond_pbkdf2_partencrypted_part = xor_encrypt(first_pbkdf2_part, key=second_pbkdf2_part)Save onlyencrypted_partand giveninit_pbkdf2_saltfrom clientLogin - client browser / JavaScript part:Use request loginserver send html login form with a randomserver_challengevalueUser enters hisusernameandpasswordAjax Request theinit_pbkdf2_saltfrom server with the givenusernamegenerate the auth data:pbkdf2_temp_hash =pbkdf2("PlainPassword", init_pbkdf2_salt)splitpbkdf2_temp_hashintofirst_pbkdf2_partandsecond_pbkdf2_partcnonce = SHA1(random data)pbkdf2_hash = pbkdf2(first_pbkdf2_part, salt=cnonce + server_challenge)sendpbkdf2_hash,second_pbkdf2_partandcnonceto the servervalidation on the serverclient POST data:pbkdf2_hash,second_pbkdf2_partandcnonceget transmittedserver_challengevalue from sessiongetencrypted_partandsaltfrom database via givenusernamefirst_pbkdf2_part = xor_decrypt(encrypted_part, key=second_pbkdf2_part)test_hash = pbkdf2(first_pbkdf2_part, key=cnonce + server_challenge)comparetest_hashwith transmittedpbkdf2_hashsecure?Secure-JS-Login is not really secure in comparison to https! e.g. the client can’t validate if he really communicate with the server or with aMan-in-the-middle attack.However the used procedure is safer than plain-text authentication. In addition, on the server no plain-text passwords are stored. With the data that are stored on the server, can not be used alone.If you havehttps, you can combine it with Secure-JS-Login, similar to combine a digest auth with https.More information:Warum Secure-JS-Login Sinn macht…(german only, sorry)why?Many, if not even all CMS/wiki/forum, used unsecure Login. User name and password send inplaintextover the Internet. A reliable solution offers onlyhttps.The Problem: No Provider offers secured HTTP connection for little money :(alternative solutionsDigest access authentication(implementation in django exist:django-digest):proBrowser implemented it, so no additional JavaScript neededconsPassword hash must be saved on the server, without any salt! The hash can be used for login, because:hash = MD5(username:realm:password)used old MD5 hashtryoute.g.:~ $ virtualenv secure-js-login-env
~ $ cd secure-js-login-env
~/secure-js-login-env $ source bin/activate

# install secure-js-login as "editable" to have access to example project server and unittests:

(secure-js-login-env)~/secure-js-login-env $ pip install -e git+git://github.com/jedie/django-secure-js-login.git#egg=django-secure-js-login

run example project server:
{{{
(secure-js-login-env)~/secure-js-login-env $ cd src/django-secure-js-login/
(secure-js-login-env)~/secure-js-login-env/src/django-secure-js-login $ ./run_example_server.shrun inittests:(secure-js-login-env)~/secure-js-login-env/src/django-secure-js-login $ ./runtests.pyto run the Live-Server-Tests, installseleniume.g.:(secure-js-login-env)~/secure-js-login-env/src/django-secure-js-login $ pip install selenium
(secure-js-login-env)~/secure-js-login-env/src/django-secure-js-login $ ./runtests.pyVersion compatibilitysecure-js-loginDjangoPython>=v0.1.0v1.7, v1.8v2.7, v3.4(These are the unittests variants. Maybe other versions are compatible, too.)changelogv0.2.0 - 10.05.2015:increase default PBKDF2 iteration after test on a Raspberry Pi 1more unitestsHonypot login raise “normal” form errorscode cleanupDocu updatev0.1.0 - 06.05.2015:initial release as reuseable appUse PBKDF203.05.2015:Split fromPyLucid CMS ‘auth’ plugin03.2010:Use ajax request via jQuery(de)11.07.2007:New SHA challenge response procedure(de)01.06.2005:first implementation of a MD5 login in PyLucid(de)info linksPython-Forum Threads (de):Digest auth als Alternative?(03.2010)Sinn oder Unsinn des PyLucids Secure-JS-Login…(12.2006)Wie Session-Hijacking verhindern?(12.2006)Diskussion auf de.comp.lang.python(08.2006)project linksGithubhttp://github.com/jedie/django-secure-js-loginPython Packageshttp://pypi.python.org/pypi/django-secure-js-login/Travis CIhttps://travis-ci.org/jedie/django-secure-js-login/Used JavaScript ImplementationsSHA1 - JavaScript implementation of the Secure Hash Algorithm, SHA-1, as defined in FIPS 180-1http://pajhome.org.uk/crypt/md5/sha1.htmlImplemented by Paul JohnstonDistributed under the BSD LicenseStored under:secure_js_login/static/secure_js_login/sha.jsPBKDF2 - JavaScript implementation of Password-Based Key Derivation Function 2 as defined in RFC 2898http://anandam.name/pbkdf2/Implemented by Parvez AnandamDistributed under the BSD licenseStored under:secure_js_login/static/secure_js_login/pbkdf2.jscontactCome into the conversation, besides the github communication features:IRC#pylucid on freenode.net (Yes, the PyLucid channel…)webchathttps://webchat.freenode.net/?channels=pylucid