diff --git a/accounts/tests/test_login_lockout.py b/accounts/tests/test_login_lockout.py index 47b1cfc0..a5713175 100644 --- a/accounts/tests/test_login_lockout.py +++ b/accounts/tests/test_login_lockout.py @@ -38,6 +38,14 @@ class LoginLockoutTests(TestCase): self.login("wrong") self.assertEqual(self.login("right-pass-1").status_code, 302) + def test_a_successful_login_is_logged_on_the_logs_page_only(self): + from axes.models import AccessLog + from logs.models import Logs + + self.assertEqual(self.login("right-pass-1").status_code, 302) + self.assertTrue(Logs.objects.filter(user="lo-user").exists()) + self.assertFalse(AccessLog.objects.exists()) + def test_the_proxy_header_is_trusted_only_from_the_local_proxy(self): # direct requests: X-Real-IP is ignored, so changing it does not escape the lock for n in range(3): diff --git a/webvirtcloud/settings.py.template b/webvirtcloud/settings.py.template index c301346f..1d81179e 100644 --- a/webvirtcloud/settings.py.template +++ b/webvirtcloud/settings.py.template @@ -191,6 +191,8 @@ AXES_FAILURE_LIMIT = "accounts.lockout.failure_limit" AXES_COOLOFF_TIME = "accounts.lockout.cooloff_time" AXES_LOCKOUT_PARAMETERS = [["username", "ip_address"]] AXES_RESET_ON_SUCCESS = True +# successful logins are on the Logs page; django-axes' own record of them would only grow +AXES_DISABLE_ACCESS_LOG = True AXES_CLIENT_IP_CALLABLE = "accounts.lockout.client_ip" # Reverse proxies other than a local one whose X-Real-IP header gives the # client address, e.g. ["10.0.0.5", "172.18.0.0/16"]