ebbe.bassandClaude Sonnet 5.5
3c69c2a156
Authorization-code flow with PKCE through an idp adapter (with a fake), ID token validation, identity and roles resolved from the directory with a short cache, refusal of unknown, disabled and locked accounts with one generic page, sessions that end when the account becomes unavailable, sign-out that ends the server-side session, role decorators and the trusted-proxy client address rule. Adds the OIDC_* and PUBLIC_BASE_URL configuration. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC
53 lines
1.6 KiB
Python
53 lines
1.6 KiB
Python
"""Session limits, client address and the signed-in user.
|
|
|
|
The idle limit is SESSION_COOKIE_AGE with save-every-request; the absolute limit is below.
|
|
"""
|
|
|
|
import time
|
|
|
|
from django.conf import settings
|
|
|
|
from . import identity
|
|
from .clientip import client_ip, parse_networks
|
|
from .session_store import CREATED_AT
|
|
|
|
|
|
class AbsoluteSessionLimitMiddleware:
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
session = request.session
|
|
created = session.get(CREATED_AT)
|
|
if created is not None and time.time() - created > settings.SESSION_ABSOLUTE_SECONDS:
|
|
# flush() deletes the row; the empty session makes SessionMiddleware clear the cookie.
|
|
session.flush()
|
|
return self.get_response(request)
|
|
|
|
|
|
class ClientIpMiddleware:
|
|
"""Set request.client_ip from the peer and, behind a trusted proxy, X-Forwarded-For (AD-7)."""
|
|
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
self.trusted = parse_networks(settings.TRUSTED_PROXIES)
|
|
|
|
def __call__(self, request):
|
|
request.client_ip = client_ip(
|
|
request.META.get("REMOTE_ADDR", ""),
|
|
request.META.get("HTTP_X_FORWARDED_FOR", ""),
|
|
self.trusted,
|
|
)
|
|
return self.get_response(request)
|
|
|
|
|
|
class CurrentUserMiddleware:
|
|
"""Set request.portal_user: the signed-in user with roles, or None (AD-5)."""
|
|
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
request.portal_user = identity.current(request)
|
|
return self.get_response(request)
|