{"categories":[{"label":"Libraries","url":"https://skillfed.io/packages/category/software-development-libraries/9"},{"label":"Python Modules","url":"https://skillfed.io/packages/category/software-development-libraries-python-modules/18"},{"label":"Security","url":"https://skillfed.io/packages/category/security/2"},{"label":"Dynamic Content","url":"https://skillfed.io/packages/category/internet-www-http-dynamic-content/3"}],"enrichment":{"capability":"Blocks brute-force login attempts in Django by tracking failed attempts via Redis cache, without requiring database queries on each login check.","skillfed_tags":["authentication","rate-limiting","redis"],"use_cases":["Protect a public Django login form from credential-stuffing attacks by blocking IPs after repeated failures.","Audit login attempts by storing them in the database while using Redis for fast real-time blocking decisions.","Unblock users and IPs manually via the Django admin interface when legitimate users are locked out.","Configure different block thresholds and durations for different deployment environments without code changes.","Run scheduled cleanup jobs to prune old login attempt records and keep the database table size manageable."],"what_it_does":"django-defender is a Django middleware that prevents brute-force login attacks by tracking failed authentication attempts in Redis rather than the database. When a user or IP address exceeds a configurable threshold of failed attempts, they are temporarily blocked from further login tries. The package logs all attempts to the database for auditing, supports reverse proxies with custom IP headers, and allows rate limiting by username, IP address, or both.\n\nIt prioritizes speed\u2014the design goal is to add minimal latency to login requests by using Redis for real-time checks instead of database queries. The package includes Django admin pages to view blocked users and recent attempts, a management command to clean up old records, and signals for custom handling when blocks occur. Configuration covers Redis connection details, block duration, and attempt thresholds.","worth_installing":"Yes, with conditions. Install if you need fast, Redis-backed brute-force protection and can manage a Redis dependency. The package is production-stable and carries no known vulnerabilities, but maintenance is slow (911 days since last release). It is suitable for sites prioritizing login speed over database-backed audit trails; if you need tighter integration with Django's auth system or don't want to run Redis, consider alternatives."},"id":"django-defender","links":{"html":"https://skillfed.io/packages/django-defender","md":"https://skillfed.io/packages/django-defender.md","pypi":"https://pypi.org/project/django-defender/"},"maintenance":{"status":"aging"},"meta":{"latest_release":"2024-02-15","license_spdx":null,"license_treatment":"permissive","name":"django-defender","python_support":"supports_current","summary":"redis based Django app that locks out users after too many failed login attempts."},"popularity":{"monthly_downloads":136140,"position":11404,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.9.8"}