Package: django-basic-auth-ip-whitelist
This simple package ships middleware that lets you to set basic authentication
and IP whitelisting via Django settings.Use caseThis package has been created for staging and demo sites that need to be
completely hidden from the Internet behind a password or accessible only to
certain IP networks.Do not depend on this package to protect highly valuable information. This
package is at a good way to disable staging sites being discovered by
search engines and Internet users trying to access staging sites. It is
advised that any sensitive information is protected usingDjango authentication
system.RequirementsDjango 1.8, 1.9, 1.10, 1.11, 2.0, 2.1, 2.2 or 3.0.Python 3.4, 3.5, 3.6, 3.7 or 3.8.InstallationThe package is onPyPIso you can
just install it with pip.pipinstalldjango-basic-auth-ip-whitelistConfigurationIn your Django settings you can configure the following settings:BASIC_AUTH_LOGINandBASIC_AUTH_PASSWORDCredentials that you want to use with your basic authentication.BASIC_AUTH_WHITELISTED_IP_NETWORKSSet a list of network ranges (strings) compatible with Python’sipaddress.ip_networkthat you want to be able to access the website without authentication
from. It must be either a string with networks separated by comma or
Python iterable.BASIC_AUTH_REALMString specifying the realm of the default response.Example settingsMIDDLEWARE+=['baipw.middleware.BasicAuthIPWhitelistMiddleware']BASIC_AUTH_LOGIN='somelogin'BASIC_AUTH_PASSWORD='greatpassword'BASIC_AUTH_WHITELISTED_IP_NETWORKS=['192.168.0.0/28','2001:db00::0/24',]Advanced customisationGetting IPIf you want to have a custom behaviour when getting IP, you can create a
custom function that takes request as a parameter and specify path to it
in theBASIC_AUTH_GET_CLIENT_IP_FUNCTIONsettings, e.g.BASIC_AUTH_GET_CLIENT_IP_FUNCTION='utils.ip.get_client_ip'BASIC_AUTH_WHITELISTED_HTTP_HOSTSSet a list of hosts that your website will be open to without basic
authentication. This is useful if your website is hosted under multiple domains
and you want only one of them to be publicly visible, e.g. by search engines.This is by no means a security feature. Please do not use to secure your
site.BASIC_AUTH_WHITELISTED_HTTP_HOSTS=['your-public-domain.com',]BASIC_AUTH_WHITELISTED_PATHSSet a list of paths that your website will serve without basic authentication.
This can be used to support API integrations for example with third-party
services which don’t support basic authentication.Paths listed in the settingBASIC_AUTH_WHITELISTED_PATHSare treated as roots, and any subpath will be whitelisted too. For example:BASIC_AUTH_WHITELISTED_PATHS=['/api',]This will open up the pathhttps://mydomain.com/api/, as well as anything
below it, e.g.https://mydomain.com/api/document/1/.BASIC_AUTH_RESPONSE_TEMPLATEIf you want to display a different template on the 401 page, please use this
setting to point at the template.BASIC_AUTH_RESPONSE_TEMPLATE='401.html'BASIC_AUTH_RESPONSE_CLASSIf you want to specify custom response class, you can do so with this setting.
Provide the path as a string.BASIC_AUTH_RESPONSE_CLASS='yourmodule.response.CustomUnathorisedResponse'BASIC_AUTH_DISABLE_CONSUMING_AUTHORIZATION_HEADERSet this setting to True if you want the Authorization HTTP header to not be deleted from the request object after it has been used by this package’s middleware.BASIC_AUTH_DISABLE_CONSUMING_AUTHORIZATION_HEADER=TrueSkip middlewareYou can skip the middleware by setting_skip_basic_auth_ip_whitelist_middleware_checkattribute on the request toTrue.setattr(request,'_skip_basic_auth_ip_whitelist_middleware_check',True)This may be handy if you have other middleware that you want to have
co-existing different middleware that restrict access to the website.