MicroPyramid / django-mfa / 70

87%

push

travis-ci

Improved security of remember-my-browser cookie  (#32)

* Make it work with Django 2.0.7

* No need to specify the namespace when including django-mfa urls

* Once MFA is successfuly enabled redirect to LOGIN_REDIRECT_URL
Pass optional settings.MFA_ISSUER_NAME to the Authenticator app via QR code

* Added remember-my-browser, a feature allowing to use cookie to remember that
a code has already been entered successfully on a browser and not ask again
for a defined number of days

* Use redirect to LOGIN_REDIRECT_URL instead of HttpResponseRedirect to support
both url path and urlpattern name

* Don't set the remember-my-browser cookie when MFA is enabled.  Make the user
enter the code on next login
Set cookie secure flag based on DEBUG

* Delete the remember-my-browser cookie when disabling MFA

* Fixed required django version in setup.py to >=1.10
Formatting fix in Readme.rst

* Using a fixed salt for Remember-my-browser cookie signing is insecure.
Better to use different salt for different users.  Derive the salt from user's
OTP secret.

* changed python to 3.5

* removed test cases temp

20 of 20 new or added lines in 2 files covered. (100.0%)

97 of 296 relevant lines covered (32.77%)

0.33 hits per line