Commit 2a687ce8 authored by Tanner Prestegard's avatar Tanner Prestegard Committed by GraceDB

Set up django-user-sessions

Add django-user-sessions package for more easily managing sessions
and correlating them with user accounts.
parent 4128851a
......@@ -66,6 +66,11 @@ USE_TZ = True
ALLOWED_HOSTS = ['localhost', '127.0.0.1', SERVER_FQDN,
'{0}.ligo.org'.format(SERVER_HOSTNAME)]
# Sessions settings -----------------------------------------------------------
SESSION_COOKIE_AGE = 3600
SESSION_ENGINE = 'user_sessions.backends.db'
LOGOUT_REDIRECT_URL = '/'
# LVAlert and LVAlert Overseer settings ---------------------------------------
# Switches which control whether alerts are sent out
SEND_XMPP_ALERTS = False
......@@ -307,7 +312,8 @@ MIDDLEWARE = [
'core.middleware.api.ClientVersionMiddleware',
'core.middleware.api.CliExceptionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'core.middleware.proxy.XForwardedForMiddleware',
'user_sessions.middleware.SessionMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'ligoauth.middleware.ShibbolethWebAuthMiddleware',
......@@ -326,7 +332,7 @@ INSTALLED_APPS = [
'django.contrib.auth',
'django.contrib.admin',
'django.contrib.contenttypes',
'django.contrib.sessions',
'user_sessions',
'django.contrib.sites',
'django.contrib.staticfiles',
'django.contrib.messages',
......@@ -342,6 +348,7 @@ INSTALLED_APPS = [
'guardian',
'django_twilio',
'django_extensions',
'django.contrib.sessions',
]
# Aliases for django-extensions shell_plus
......
......@@ -38,12 +38,6 @@ if 'silk' in INSTALLED_APPS:
# prevent DOS attacks, so should not be changed in production.
DATA_UPLOAD_MAX_MEMORY_SIZE = 20*(1024**2)
# Add XForwardedFor middleware directly before debug_toolbar middleware
# if debug_toolbar is enabled and DEBUG is True.
if DEBUG and debug_middleware in MIDDLEWARE:
MIDDLEWARE.insert(MIDDLEWARE.index(debug_middleware),
'core.middleware.proxy.XForwardedForMiddleware')
# Tuple of IPs which are marked as internal, useful for debugging.
# Tanner (5 Dec. 2017): DON'T CHANGE THIS! Django Debug Toolbar exposes
# some headers which we want to keep hidden. So to be safe, we only allow
......
......@@ -65,6 +65,9 @@ urlpatterns = [
# (r'^admin/doc/', include('django.contrib.admindocs.urls')),
url(r'^admin/', admin.site.urls),
# sessions
#url(r'', include('user_sessions.urls', 'user_sessions')),
]
# We don't require settings.DEBUG for django-silk since running unit tests
......
from django.utils.deprecation import MiddlewareMixin
from django.conf import settings
from django.http import HttpResponse
class XForwardedForMiddleware(MiddlewareMixin):
def process_request(self, request):
if ('HTTP_X_FORWARDED_FOR' in request.META and settings.DEBUG and
'debug_toolbar' in settings.INSTALLED_APPS):
# If we're in debugging mode and the debug toolbar is on AND there
# is a forwarded IP address, then set REMOTE_ADDR to be the value
# of the HTTP_X_FORWARDED_FOR header. This allows the debug toolbar
# to work as expected. As of now, there is only one other place in
# the server code where REMOTE_ADDR is used, and it's handled
# properly, so this won't affect it.
class XForwardedForMiddleware(object):
def __init__(self, get_response):
self.get_response = get_response
def __call__(self, request):
# Process request -----------------------------------------------------
if request.META.has_key('HTTP_X_FORWARDED_FOR'):
request.META['REMOTE_ADDR'] = \
request.META['HTTP_X_FORWARDED_FOR'].split(",")[0].strip()
# Get response --------------------------------------------------------
response = self.get_response(request)
# Process response ----------------------------------------------------
# Return response -----------------------------------------------------
return response
......@@ -7,6 +7,7 @@ django-maintenance-mode==0.7.2
django-model-utils==3.1.1
django-silk==3.0.1
django-twilio==0.9.0
django-user-sessions==1.6.0
djangorestframework==3.9.0
flake8==3.5.0
gunicorn==19.7.1
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment