Settings for django-session-security.
Note that this module will raise a warning if settings.SESSION_EXPIRE_AT_BROWSER_CLOSE is not True, because it makes no sense to use this app with SESSION_EXPIRE_AT_BROWSER_CLOSE to False.
SessionSecurityMiddleware is the heart of the security that this application attemps to provide.
To install this middleware, add to your settings.MIDDLEWARE_CLASSES:
'session_security.middleware.SessionSecurityMiddleware'
Make sure that it is placed after authentication middlewares.
Helpers to support json encoding of session data
One url meant to be used by JavaScript.
To install this url, include it in urlpatterns definition in urls.py, ie:
urlpatterns = patterns('',
# ....
url(r'session_security/', include('session_security.urls')),
# ....
)
One view method for AJAX requests by SessionSecurity objects.
This view is just in charge of returning the number of seconds since the ‘real last activity’ that is maintained in the session by the middleware.
Constructor. Called in the URLconf; can contain helpful extra keyword arguments, and other things.
{% load i18n %}
<div id="session_security_warning" class="session_security" style="display:none">
<div class="session_security_overlay"></div>
<div class="session_security_modal">
<h3>{% trans 'Your session is about to expire' %}</h3>
<p>{% trans 'Click to extend your session.' %}</p>
</div>
</div>
{% comment %}
This demonstrates how to setup session security client side stuff on your own.
It provides sensible defaults so you could start with just::
{% include 'session_security/all.html' %}
{% endcomment %}
{% load session_security_tags %}
{% load i18n l10n %}
{% load url from future %}
{% load static from staticfiles %}
{# If the user is not authenticated then there is no session to secure ! #}
{% if request.user.is_authenticated %}
{# The modal dialog stylesheet, it's pretty light so it should be easy to hack #}
<link rel="stylesheet" type="text/css" href="{% static 'session_security/style.css' %}"></link>
{# Include the template that actually contains the modal dialog #}
{% include 'session_security/dialog.html' %}
{# Load SessionSecurity javascript 'class', jquery should be loaded - by you - at this point #}
<script type="text/javascript" src="{% static 'session_security/script.js' %}"></script>
{# Bootstrap a SessionSecurity instance as the sessionSecurity global variable #}
{% localize off %}
<script type="text/javascript">
var sessionSecurity = new yourlabs.SessionSecurity({
pingUrl: '{% url 'session_security_ping' %}',
warnAfter: {{ request|warn_after|unlocalize }},
expireAfter: {{ request|expire_after|unlocalize }},
confirmFormDiscard: "{% trans 'You have unsaved changes in a form of this page.' %}"
});
</script>
{% endlocalize %}
{% endif %}
Read the script documentation
/* credit: http://www.csslab.cl/2008/01/30/ventana-modal-solo-con-css/ */
.session_security_overlay {
position: fixed;
top: 0;
left: 0;
width: 100%;
height: 100%;
background: #000;
z-index:1001;
opacity:.75;
-moz-opacity: 0.75;
filter: alpha(opacity=75);
}
.session_security_modal {
position: fixed;
top: 25%;
left: 25%;
width: 50%;
padding: 16px;
background: #fff;
color: #333;
z-index:1002;
overflow: auto;
text-align: center;
}