Password protect a whole django app

Question

I am running a simple staging env on heroku and I am now looking to password protect the whole app with some sort of simple authentication

I am wondering if there is a simple app or middleware that already supports this. Have tried looking around for solutions with Heroku / Cloudflare and django, but nothing seems really straight forward.

Django 1.3.1

Answer 1

I use django-lockdown for exactly this purpose. It allows you to add a simple password over the whole of a dev site, without having to add in any extra auth bits on your views that aren't used outside of a dev environment. It also means you can login as admin, or regular users to test whatever your site does

https://github.com/Dunedan/django-lockdown

I use Heroku and Lockdown with this bit of code in my settings.py file

USE_LOCKDOWN = os.environ.get('USE_LOCKDOWN', 'False') == 'True'
if USE_LOCKDOWN:
    INSTALLED_APPS += ('lockdown',)
    MIDDLEWARE_CLASSES += ('lockdown.middleware.LockdownMiddleware',)
    LOCKDOWN_PASSWORDS = (os.environ.get('LOCKDOWN_PASSWORD', 'False'),)
    LOCKDOWN_URL_EXCEPTIONS = (r'^/some/url/not/locked/down/$',)

Then obviously set a config var of USE_LOCKDOWN as True on my dev site, and False on my production site so no need to change the code for either.

Answer 2

Django's authentication framework has built-in utilities @login_required which helps you to password protect your view functions (and its corresponding "url" of course).

Usage like this:-

from django.contrib.auth.decorators import permission_required, login_required

@login_required
def view_organization(request, org_slug):
    """
    Only permit a logged in user to view the organization.
    """
    org = get_object_or_404(organization, slug=org_slug)
    org_users = organizationuser.objects.filter(organization=org,\
                                                organization__is_active=true)

    template = 'organizations/view_organization.html'
    template_vars = {'org_users': org_users, 'org': org}
    return render(request, template, template_vars)

For advanced access control, use @permission_required decorator.