Django-mfa (Multi Factor Authentication) is a simple package to add extra layer of security to your django web application. It gives web app a randomly changing password as an extra protection and supports u2f too
License: MIT License
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
I have just installed the mfa module and followed the steps. Using Google Authenticator it says that the barcode is not valid. Do you have any idea about this?
This issue occurs after first setting up the Django-mfa in a project. when going to "/settings/security/" this error comes up.
I resolved it by changing the "{% load staticfiles %}" to "{% load static %}" in the base.html template found in the library files under the route seen in the attached photo.
Hi team (@chaitu210 @gregkster ),
I have just upgraded the django-mfa and tested it without making any change, I am facing the following error when I click 'Setup using an app' button in the configuration window. Can you please help me with it !
Environment:
Request Method: POST
Request URL: http://127.0.0.1:8000/settings/mfa/configure/
Django Version: 1.10.5
Python Version: 2.7.10
Installed Applications:
['angeekaram.apps.AngeekaramConfig',
'vasool_raja_mbbs.apps.VasoolRajaMbbsConfig',
'maya_bazaar.apps.MayaBazaarConfig',
'django.contrib.admin',
'django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.messages',
'django.contrib.staticfiles',
'django_countries',
'django_extensions',
'django_mfa',
'django_user_agents']
Installed Middleware:
['django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
'django_mfa.middleware.MfaMiddleware',
'django_user_agents.middleware.UserAgentMiddleware']
Template error:
In template /Users/guganvigneshs/Dropbox/WORK_SPACE/PROJECT-COLORS/colors/templates/django_mfa/configure.html, error at line 35
Reverse for 'enable_mfa' with arguments '()' and keyword arguments '{}' not found. 0 pattern(s) tried: [] 25 : <div class="simple-box-footer">
26 : Scan the image above with the two-factor authentication app on your phone.
27 : </div>
28 : </div>
29 : <p>
30 : After scanning the barcode image, the app will display a six-digit code that
31 : you can enter below.
32 : </p>
33 : <hr>
34 : <!-- </textarea> --><!-- '"` -->
35 : <form accept-charset="UTF-8" action=" {% url 'mfa:enable_mfa' %} " method="post">
36 : {% csrf_token %}
37 : <dl class="form-group">
38 : <dt>
39 : <label for="two-factor-code">
40 : <h3 class="simple-box-title">
41 : 2. Enter the six-digit code from the application
42 : </h3>
43 : </label>
44 : </dt>
45 : <dd>
Traceback:
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/core/handlers/exception.py" in inner
39. response = get_response(request)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/core/handlers/base.py" in _get_response
187. response = self.process_exception_by_middleware(e, request)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/core/handlers/base.py" in _get_response
185. response = wrapped_callback(request, *callback_args, **callback_kwargs)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/contrib/auth/decorators.py" in _wrapped_view
23. return view_func(request, *args, **kwargs)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django_mfa/views.py" in configure_mfa
42. return render(request, 'django_mfa/configure.html', {"qr_code": qr_code, "secret_key": base_32_secret_utf8})
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/shortcuts.py" in render
30. content = loader.render_to_string(template_name, context, request, using=using)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/loader.py" in render_to_string
68. return template.render(context, request)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/backends/django.py" in render
66. return self.template.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render
208. return self._render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in _render
199. return self.nodelist.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render
994. bit = node.render_annotated(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render_annotated
961. return self.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/loader_tags.py" in render
174. return compiled_parent._render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in _render
199. return self.nodelist.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render
994. bit = node.render_annotated(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render_annotated
961. return self.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/loader_tags.py" in render
174. return compiled_parent._render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in _render
199. return self.nodelist.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render
994. bit = node.render_annotated(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render_annotated
961. return self.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/loader_tags.py" in render
70. result = block.nodelist.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render
994. bit = node.render_annotated(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render_annotated
961. return self.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/defaulttags.py" in render
315. return nodelist.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render
994. bit = node.render_annotated(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render_annotated
961. return self.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/loader_tags.py" in render
70. result = block.nodelist.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render
994. bit = node.render_annotated(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render_annotated
961. return self.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/defaulttags.py" in render
315. return nodelist.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render
994. bit = node.render_annotated(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render_annotated
961. return self.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/defaulttags.py" in render
315. return nodelist.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render
994. bit = node.render_annotated(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/base.py" in render_annotated
961. return self.render(context)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/template/defaulttags.py" in render
439. url = reverse(view_name, args=args, kwargs=kwargs, current_app=current_app)
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/urls/base.py" in reverse
91. return force_text(iri_to_uri(resolver._reverse_with_prefix(view, prefix, *args, **kwargs)))
File "/Users/guganvigneshs/colors/lib/python2.7/site-packages/django/urls/resolvers.py" in _reverse_with_prefix
392. (lookup_view_s, args, kwargs, len(patterns), patterns)
Exception Type: NoReverseMatch at /settings/mfa/configure/
Exception Value: Reverse for 'enable_mfa' with arguments '()' and keyword arguments '{}' not found. 0 pattern(s) tried: []
Hi Django-MFA team:
We have been using Django-mfa in our Django application for a few years without issue. Recently, we have encountered the following issue:
The barcode is not loading when trying to enable the MFA in a Django application, it seems the following is not accessible anymore:
https://chart.apis.google.com/chart?chs=150x150&cht=qr&chl=otpauth%3A%2F%2Ftotp%2Frontest%3Fsecret%3D4IRAR2IE3PBSOTXS&choe=UTF-8
We are currently using the django_mfa-3.2.
Thanks
-Ron
At the moment (october 2020) this Plugin does not support Django 4.0 (released in december 2021).
Please update the plugin so Django 4.0 is supported.
Hi im a beginer trying to sort these issues ... can you please help me out ?
https://django-mfa.readthedocs.io/en/latest/installation_setup.html
Shows Django requirement as < 1.10
Python | >= 2.6 (or Python 3)
Django | < 1.10
setup.py has:
install_requires = [
'asn1crypto==0.24.0',
'cffi==1.12.2',
'cryptography==2.6.1',
'dj-database-url==0.4.1',
'Django<=2.1.5',
'django-argonauts==1.2.0',
'django-debug-toolbar==1.11',
'gunicorn==19.6.0',
'psycopg2==2.7',
'pycparser==2.19',
'python-u2flib-server==5.0.0',
'pytz==2018.9',
'qrcode==6.1',
'six==1.12.0',
'sqlparse==0.3.0',
'whitenoise==3.1',
]
This makes it impossible to use in any application, because it it is likely the application has different versions pinned.
Furthermore psycopg version 2.7 appears to be broken, need version 2.7.7.
There is no need to be so precise about versions in setup.py, do that in requirements.txt.
django.db.utils.OperationalError: (1170, "BLOB/TEXT column 'public_key' used in key specification without a key length")
in ./lib/python3.6/site-packages/django_mfa/migrations/0001_initial.py"
('public_key', models.TextField(unique=True)),
After migrating to django_mfa v2 from v1, and after setting up MFA for a user, I receive the following error message on the recovery code page.
Environment:
Request Method: GET
Request URL: http://admin.podverse.fm/settings/recovery/codes/
Django Version: 2.1.5
Python Version: 3.7.4
Installed Applications:
['django.contrib.admin',
'django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.messages',
'django.contrib.staticfiles',
'podverse_db.apps.PodverseDbConfig',
'django_mfa']
Installed Middleware:
['django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
'django_mfa.middleware.MfaMiddleware']
Traceback:
File "/usr/local/lib/python3.7/site-packages/django/db/backends/utils.py" in _execute
85. return self.cursor.execute(sql, params)
The above exception (value too long for type character varying(10)
) was the direct cause of the following exception:
File "/usr/local/lib/python3.7/site-packages/django/core/handlers/exception.py" in inner
34. response = get_response(request)
File "/usr/local/lib/python3.7/site-packages/django/core/handlers/base.py" in _get_response
126. response = self.process_exception_by_middleware(e, request)
File "/usr/local/lib/python3.7/site-packages/django/core/handlers/base.py" in _get_response
124. response = wrapped_callback(request, *callback_args, **callback_kwargs)
File "/usr/local/lib/python3.7/site-packages/django/contrib/auth/decorators.py" in _wrapped_view
21. return view_func(request, *args, **kwargs)
File "/usr/local/lib/python3.7/site-packages/django_mfa/views.py" in recovery_codes
233. codes = generate_user_recovery_codes(request.user.id)
File "/usr/local/lib/python3.7/site-packages/django_mfa/views.py" in generate_user_recovery_codes
220. user=UserOTP.objects.get(user=user_id), secret_code=code)
File "/usr/local/lib/python3.7/site-packages/django/db/models/manager.py" in manager_method
82. return getattr(self.get_queryset(), name)(*args, **kwargs)
File "/usr/local/lib/python3.7/site-packages/django/db/models/query.py" in create
413. obj.save(force_insert=True, using=self.db)
File "/usr/local/lib/python3.7/site-packages/django/db/models/base.py" in save
718. force_update=force_update, update_fields=update_fields)
File "/usr/local/lib/python3.7/site-packages/django/db/models/base.py" in save_base
748. updated = self._save_table(raw, cls, force_insert, force_update, using, update_fields)
File "/usr/local/lib/python3.7/site-packages/django/db/models/base.py" in _save_table
831. result = self._do_insert(cls._base_manager, using, fields, update_pk, raw)
File "/usr/local/lib/python3.7/site-packages/django/db/models/base.py" in _do_insert
869. using=using, raw=raw)
File "/usr/local/lib/python3.7/site-packages/django/db/models/manager.py" in manager_method
82. return getattr(self.get_queryset(), name)(*args, **kwargs)
File "/usr/local/lib/python3.7/site-packages/django/db/models/query.py" in _insert
1136. return query.get_compiler(using=using).execute_sql(return_id)
File "/usr/local/lib/python3.7/site-packages/django/db/models/sql/compiler.py" in execute_sql
1289. cursor.execute(sql, params)
File "/usr/local/lib/python3.7/site-packages/django/db/backends/utils.py" in execute
100. return super().execute(sql, params)
File "/usr/local/lib/python3.7/site-packages/django/db/backends/utils.py" in execute
68. return self._execute_with_wrappers(sql, params, many=False, executor=self._execute)
File "/usr/local/lib/python3.7/site-packages/django/db/backends/utils.py" in _execute_with_wrappers
77. return executor(sql, params, many, context)
File "/usr/local/lib/python3.7/site-packages/django/db/backends/utils.py" in _execute
85. return self.cursor.execute(sql, params)
File "/usr/local/lib/python3.7/site-packages/django/db/utils.py" in __exit__
89. raise dj_exc_value.with_traceback(traceback) from exc_value
File "/usr/local/lib/python3.7/site-packages/django/db/backends/utils.py" in _execute
85. return self.cursor.execute(sql, params)
Exception Type: DataError at /settings/recovery/codes/
Exception Value: value too long for type character varying(10)
Could I have done something wrong? Or is there a bug?
Hi,
Could you update the requirements to Django<=1.11.3?
Right now, installing via pip downgrades an up-to-date django installation.
Thanks,
Lieven
Consider integrating u2f keys like https://github.com/gavinwahl/django-u2f/blob/master/django_u2f/static/django_u2f/u2f-api.js
Guys, to whomsoever who helped get this app on board, I request you to include the issuer name, because once the mfa code is scanned using the google authenticator, the app for which these codes are used is missing so it would be great if we can include the issuer name to avoid confusion.
Screen Shot :
please treat this as one of a major issue and fix !
Thanks in advance
setup.py indicates that you can't run this app with a Django version greater than 2.1.5.
Could you update the code and/or dependency spec to support Django 3? Thanks!
Last I checked, django-mfa doesn't support backup codes. That's not a dealbreaker for our project as long as there's a way for us to disable MFA and recover access in the event we lose all of our MFA devices. Is there a recovery process we could use if that happens? How would that work? A SQL query perhaps?
Anyway django-mfa is extremely convenient, thank you! :)
First let me say I'm new at Github, so I'm sorry if this is not the right place to raise questions and suggestions.
Also, would like to thanks the devs, this is the best MFA package for django that I found so far. Really appreciate the work!
I would like to suggest that it would be a good security practice to ask for a 2FA code when the user choose to disable the MFA Auth. [Prevent someone with physical acess to the PC from disabling it, while session is still valid.
I also think it would be a good idea to provide the key together with the QR Code, at the configure.html, so the user can print/copy/write it as a backup code. I have tried to do it, unsuccefully so far. I belive that's because I'm not familiar with the encode and decode funcs in the configure_mfa at views.py. If you don't intent to add this feature, I would appreciate if someone could shed some light on how can i do it myself.
Thanks,
Clicking the Heroku button in the README results in the following stacktrace:
Traceback (most recent call last):
File "/app/.heroku/python/lib/python3.6/site-packages/django/db/backends/postgresql/base.py", line 20, in
import psycopg2 as Database
File "/app/.heroku/python/lib/python3.6/site-packages/psycopg2/init.py", line 50, in
from psycopg2._psycopg import ( # noqa
ImportError: /app/.heroku/python/lib/python3.6/site-packages/psycopg2/.libs/./libresolv-2-c4c53def.5.so: symbol __res_maybe_init version GLIBC_PRIVATE not defined in file libc.so.6 with link time reference
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "sandbox/manage.py", line 22, in
execute_from_command_line(sys.argv)
File "/app/.heroku/python/lib/python3.6/site-packages/django/core/management/init.py", line 381, in execute_from_command_line
utility.execute()
File "/app/.heroku/python/lib/python3.6/site-packages/django/core/management/init.py", line 357, in execute
django.setup()
File "/app/.heroku/python/lib/python3.6/site-packages/django/init.py", line 24, in setup
apps.populate(settings.INSTALLED_APPS)
File "/app/.heroku/python/lib/python3.6/site-packages/django/apps/registry.py", line 112, in populate
app_config.import_models()
File "/app/.heroku/python/lib/python3.6/site-packages/django/apps/config.py", line 198, in import_models
self.models_module = import_module(models_module_name)
File "/app/.heroku/python/lib/python3.6/importlib/init.py", line 126, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
File "", line 978, in _gcd_import
File "", line 961, in _find_and_load
File "", line 950, in _find_and_load_unlocked
File "", line 655, in _load_unlocked
File "", line 678, in exec_module
File "", line 205, in _call_with_frames_removed
File "/app/.heroku/python/lib/python3.6/site-packages/django/contrib/auth/models.py", line 2, in
from django.contrib.auth.base_user import AbstractBaseUser, BaseUserManager
File "/app/.heroku/python/lib/python3.6/site-packages/django/contrib/auth/base_user.py", line 47, in
class AbstractBaseUser(models.Model):
File "/app/.heroku/python/lib/python3.6/site-packages/django/db/models/base.py", line 101, in new
new_class.add_to_class('_meta', Options(meta, app_label))
File "/app/.heroku/python/lib/python3.6/site-packages/django/db/models/base.py", line 305, in add_to_class
value.contribute_to_class(cls, name)
File "/app/.heroku/python/lib/python3.6/site-packages/django/db/models/options.py", line 203, in contribute_to_class
self.db_table = truncate_name(self.db_table, connection.ops.max_name_length())
File "/app/.heroku/python/lib/python3.6/site-packages/django/db/init.py", line 33, in getattr
return getattr(connections[DEFAULT_DB_ALIAS], item)
File "/app/.heroku/python/lib/python3.6/site-packages/django/db/utils.py", line 202, in getitem
backend = load_backend(db['ENGINE'])
File "/app/.heroku/python/lib/python3.6/site-packages/django/db/utils.py", line 110, in load_backend
return import_module('%s.base' % backend_name)
File "/app/.heroku/python/lib/python3.6/importlib/init.py", line 126, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
File "/app/.heroku/python/lib/python3.6/site-packages/django/db/backends/postgresql/base.py", line 24, in
raise ImproperlyConfigured("Error loading psycopg2 module: %s" % e)
django.core.exceptions.ImproperlyConfigured: Error loading psycopg2 module: /app/.heroku/python/lib/python3.6/site-packages/psycopg2/.libs/./libresolv-2-c4c53def.5.so: symbol __res_maybe_init version GLIBC_PRIVATE not defined in file libc.so.6 with link time reference
After a clean install on a new project the u2flib_server is missing
Here is the ligne I used to install Django-mfa;
$ pip install django-mfa
Collecting django-mfa
Downloading django_mfa-2.1-py3-none-any.whl (33 kB)
Requirement already satisfied: Django>=2.2.19 in ~/.venv/lib/python3.7/site-packages (from django-mfa) (2.2.20)
Requirement already satisfied: sqlparse>=0.2.2 in ~/.venv/lib/python3.7/site-packages (from Django>=2.2.19->django-mfa) (0.4.1)
Requirement already satisfied: pytz in ~/.venv/lib/python3.7/site-packages (from Django>=2.2.19->django-mfa) (2021.1)
Installing collected packages: django-mfa
Successfully installed django-mfa-2.1after stating up the installed_apps, middleware and urls when I run my Django server I get this error stack
File "~/.venv/lib/python3.7/site-packages/django_mfa/urls.py", line 1, in <module>
from .views import *
File "~/.venv/lib/python3.7/site-packages/django_mfa/views.py", line 19, in <module>
from u2flib_server import u2f
ModuleNotFoundError: No module named 'u2flib_server'
in fact, this line
django-mfa/django_mfa/views.py
Line 19 in f51a06b
python-u2flib-server which is not in the requirements (only in the sandbox/requirements.txt how are not installed via pip install)When I installed this package, it downgraded my version of Django.
Since I have the latest django project on Django-2.0.7, while installing django-mfa, django is downgraded to Django-1.11.20 which is not desirable.
It would be great if mfa supports django 2.0.0 or > !!!
django.db.utils.OperationalError: (1170, "BLOB/TEXT column 'public_key' used in key specification without a key length")
django-mfa install requires the package python-u2flib-server (this is only documented in these github issues, but this issue is hit right away when adding the django-mfa into a requirements.txt file, so only a minor annoyance).
However, the package python-u2flib-server is now deprecated and the github documentation for python-u2flib-server refers you to a new package python-fido2
Are there any plans to add support for a supported package such as python-fido2?
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.