Add session hash to access log #1198
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
To better handle "password change" events it could be nice to insert an |
aleksihakli
approved these changes
Jun 11, 2024
| session = request.session | ||
| except AttributeError: | ||
| # when no session is available just return an empty string | ||
| return "" |
There was a problem hiding this comment.
Pondering on if this should be None or "" but both should work.
| field=models.CharField( | ||
| blank=True, | ||
| default="", | ||
| max_length=64, |
There was a problem hiding this comment.
SHA256 should be exactly 64 characters so it might be sensible to force this to either None or 64 characters with e.g. MinLengthValidator
|
Released as version 6.5.0. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR adds a new field on
AccessLogto better track sessions.There is still an issue for sessions in which a user changes its password: because
django.contrib.authcreates a new session upon password change and no logout/login signal is fired since this is neither a login nor a logout. I suppose it would be fine to keep this case "untracked" since it is not possible to hook into that method and usually changing password is not a frequent task.When no session engine is configured it falls back to current behaviour: a logout will set the
logout_timeto everyAccessLogwithout it. However this could be tolerated since there is no standard way to track such case and usually when there is no session there is not the concept of login/logout.Fixes #1190
Before submitting