mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 03:36:48 +00:00
1c60696ea1
The REST API took only the login session, so a script could not use it without a browser. A user now makes API tokens on the profile page (API Tokens tab): a name, and an expiry of 30, 90 or 365 days or none. The token is shown once, on a page that is not cached, and then kept only as a SHA-512 digest; the list shows its name, first characters, creation and expiry, and a token is deleted there. Tools send it as "Authorization: Token wvc_...", and act as its user, with that user's permissions. Making and deleting a token is logged, without the token. A password alone (HTTP Basic) still does not reach the API, as it would skip the OTP second factor: a token is made in a session that passed the login and its OTP. The token class comes first, so a refused request gets 401 with its challenge instead of 403. django-rest-knox 5.1.0 provides the tokens (accounts.ApiToken adds the name); settings.py takes "knox", KNOX_TOKEN_MODEL and REST_KNOX from the template. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| test_admin_email_otp.py | ||
| test_admin_password.py | ||
| test_api_tokens.py | ||
| test_audit_rows.py | ||
| test_change_password_permission.py | ||
| test_checks.py | ||
| test_email_otp.py | ||
| test_first_login_password.py | ||
| test_login_lockout.py | ||
| test_otp_login.py | ||
| test_security_fixes.py | ||
| test_utils.py | ||
| test_views.py | ||