Django Two-Factor Authentication
Complete Two-Factor Authentication for Django. Built on top of the one-time
password framework django-otp and Django's built-in authentication framework
django.contrib.auth for providing the easiest integration into most Django
projects. Inspired by the user experience of Google's Two-Step Authentication,
allowing users to authenticate through call, text messages (SMS), by using a
token generator app like Google Authenticator or a YubiKey hardware token
I would love to hear your feedback on this package. If you run into problems, please file an issue on GitHub, or contribute to the project by forking the repository and sending some pull requests. The package is translated into English, Dutch and other languages. Please contribute your own language using Transifex.
Test drive this app through the online example app, hosted by Heroku. It
demos most features except the Twilio integration. The example also includes
django-user-sessions for providing Django sessions with a foreign key to the
user. Although the package is optional, it improves account security control
Compatible with all supported Django (LTS) versions. At the moment of writing that's including 1.7 and 1.8 on Python 2.7, 3.2, 3.3 and 3.4. Documentation is available at readthedocs.org.
$ pip install django-two-factor-auth
On Django 1.8, also install
$ pip install django-formtools
Add the following apps to the
INSTALLED_APPS = ( ... 'django_otp', 'django_otp.plugins.otp_static', 'django_otp.plugins.otp_totp', 'two_factor', )
MIDDLEWARE_CLASSES. It must
be installed after
MIDDLEWARE_CLASSES = [ 'django.middleware.common.CommonMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django_otp.middleware.OTPMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', ]
Configure a few urls:
from django.core.urlresolvers import reverse_lazy LOGIN_URL = reverse_lazy('two_factor:login')
Add the url routes:
urlpatterns = patterns('', ... url(r'', include('two_factor.urls', 'two_factor')), )
Be sure to remove any other login routes, otherwise the two-factor authentication might be circumvented. The admin interface should be automatically patched to use the new login method.
Support for YubiKey is disabled by default, but enabling is easy. Please refer to the documentation for instructions.
- Submit issues to the issue tracker on Github.
- Fork the source code at Github.
- Write some code and make sure it is covered with unit tests.
- Send a pull request with your changes.
- Provide a translation using Transifex.
This project aims for full code-coverage, this means that your code should be well-tested. Also test branches for hardened code. You can run the full test suite with:
Or run a specific test with:
make test TARGET=tests.tests.TwilioGatewayTest
For Python compatibility, tox is used. You can run the full test suite with:
The following actions are required to push a new version:
python example/manage.py makemigrations two_factor git commit -am "Added migrations" bumpversion [major|minor|patch] git commit -am "Released [version]" git tag [version] python setup.py sdist bdist_wheel upload
The project is licensed under the MIT license.