From c6a9be4df17258228c6be9be9da8eaebaab9f3f2 Mon Sep 17 00:00:00 2001 From: Randall Tom Date: Wed, 22 Feb 2017 11:28:31 -0800 Subject: [PATCH 1/2] Adding always reset token setting support --- README.md | 4 ++++ rest_framework_expiring_authtoken/models.py | 2 +- rest_framework_expiring_authtoken/settings.py | 16 ++++++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index ea9ff55..263854c 100644 --- a/README.md +++ b/README.md @@ -54,9 +54,13 @@ Specify the desired lifespan of a token with `EXPIRING_TOKEN_LIFESPAN` in [timedelta object](https://docs.python.org/2/library/datetime.html#timedelta-objects). If not set, the default is 30 days. +Also there is a field called `ALWAYS_RESET_TOKEN`, which allows token to be reset everytime this is checked. +If not set, default is False + ```python import datetime EXPIRING_TOKEN_LIFESPAN = datetime.timedelta(days=25) +ALWAYS_RESET_TOKEN = True ``` [Set the authentication scheme](http://www.django-rest-framework.org/api-guide/authentication/#setting-the-authentication-scheme) to `rest_framework_expiring_authtoken.authentication.ExpiringTokenAuthentication` diff --git a/rest_framework_expiring_authtoken/models.py b/rest_framework_expiring_authtoken/models.py index f9407b5..901c8a8 100644 --- a/rest_framework_expiring_authtoken/models.py +++ b/rest_framework_expiring_authtoken/models.py @@ -21,6 +21,6 @@ class Meta(object): def expired(self): """Return boolean indicating token expiration.""" now = timezone.now() - if self.created < now - token_settings.EXPIRING_TOKEN_LIFESPAN: + if (self.created < now - token_settings.EXPIRING_TOKEN_LIFESPAN) or token_settings.ALWAYS_RESET_TOKEN: return True return False diff --git a/rest_framework_expiring_authtoken/settings.py b/rest_framework_expiring_authtoken/settings.py index 3825d24..da7b92c 100644 --- a/rest_framework_expiring_authtoken/settings.py +++ b/rest_framework_expiring_authtoken/settings.py @@ -21,9 +21,25 @@ def EXPIRING_TOKEN_LIFESPAN(self): """ try: val = settings.EXPIRING_TOKEN_LIFESPAN + except AttributeError: val = timedelta(days=30) return val + @property + def ALWAYS_RESET_TOKEN(self): + """ + Return if token should be reset every time at login + + Defaults to False + """ + try: + val = settings.ALWAYS_RESET_TOKEN + + except AttributeError: + val = False + + return val + token_settings = TokenSettings() From fb3f537f5948966ca38d5ddd9231b43e6d27291d Mon Sep 17 00:00:00 2001 From: Randall Tom Date: Wed, 22 Feb 2017 11:29:24 -0800 Subject: [PATCH 2/2] Adding always reset token setting support --- tests/test_authentication.py | 12 ++++++++++++ tests/test_views.py | 25 +++++++++++++++++++++++++ 2 files changed, 37 insertions(+) diff --git a/tests/test_authentication.py b/tests/test_authentication.py index a8ce9c5..99e3ed1 100644 --- a/tests/test_authentication.py +++ b/tests/test_authentication.py @@ -76,3 +76,15 @@ def test_expired_token(self): self.assertEqual(e.__str__(), 'Token has expired') else: self.fail("AuthenticationFailed not raised.") + + def test_always_reset_token(self): + """Check that token always expires.""" + with self.settings(ALWAYS_RESET_TOKEN=True): + sleep(0.001) + + try: + self.test_instance.authenticate_credentials(self.key) + except AuthenticationFailed as e: + self.assertEqual(e.__str__(), 'Token has expired') + else: + self.fail("AuthenticationFailed not raised.") diff --git a/tests/test_views.py b/tests/test_views.py index b5c050b..ec11202 100644 --- a/tests/test_views.py +++ b/tests/test_views.py @@ -114,3 +114,28 @@ def test_post_expired_token(self): self.assertEqual(token.user, self.user) self.assertEqual(response.data['token'], token.key) self.assertTrue(key_1 != key_2) + + def test_post_always_reset_token(self): + """Check that expired tokens are replaced.""" + token = ExpiringToken.objects.create(user=self.user) + key_1 = token.key + + # Make the first token expire. + with self.settings(ALWAYS_RESET_TOKEN=True): + sleep(0.001) + response = self.client.post( + '/obtain-token/', + { + 'username': self.username, + 'password': self.password + } + ) + + self.assertEqual(response.status_code, status.HTTP_200_OK) + + # Check token was renewed and the response contains the token key. + token = ExpiringToken.objects.first() + key_2 = token.key + self.assertEqual(token.user, self.user) + self.assertEqual(response.data['token'], token.key) + self.assertTrue(key_1 != key_2)