[Exploratory] Dynamic security settings configuration

[heysamtexas]

Description

EXPLORATORY TICKET - Research making django-allauth security settings configurable through admin interface.

⚠️ Complexity Warning: Security settings changes can have significant implications. Thorough testing and security review required.

Current State

Security settings hardcoded in settings.py:

• ACCOUNT_PREVENT_ENUMERATION = True
• ACCOUNT_RATE_LIMITS = {...}
• Session and redirect settings

Research Areas

1. Rate Limiting: Dynamic rate limit adjustments
2. User Enumeration: Toggle enumeration protection
3. Session Control: Dynamic session timeouts
4. Redirect Behavior: Configurable post-auth redirects

Security Considerations

• Rate Limits: Changes affect brute force protection
• Enumeration: Impacts user privacy and security
• Sessions: May affect active user sessions
• Redirects: Open redirect vulnerabilities possible

Research Questions

• Can rate limits be safely changed at runtime?
• What's the security impact of dynamic enumeration settings?
• Do session changes affect logged-in users?
• How to validate redirect URLs securely?

Implementation Risks

• High: Security misconfigurations
• Medium: Performance impact of dynamic lookups
• Medium: Compatibility with existing security measures

Proceed Only If

• Security implications are fully understood
• Changes can be validated and tested thoroughly
• Rollback mechanisms are in place
• Performance impact is acceptable

Labels: research, django-allauth, security, high-risk, complexity-warning
Priority: Low (Security review required)