valentinogagliardi / django-monitus

HTTP error reporting middleware(s) for Django

django-monitus

Tiny error reporting middleware(s) for Django. Includes the following middlewares:

• Error403EmailsMiddleware: sends an email to ADMINS on 403.
• FailedLoginMiddleware: sends an email to ADMINS on failed logins.

Requirements

Tested on Python 3.8.

Tested on Django 3.0 and 3.1.

Setup

Install from pip:

python -m pip install django-monitus

Then add it to the list of installed apps:

INSTALLED_APPS = [
...
"monitus"
...
]

Enable the desired middleware:

MIDDLEWARE = [
...
"monitus.middleware.Error403EmailsMiddleware"
...
]

Setup ADMINS in your settings:

MANAGERS = [("Juliana C.", "[email protected]")]

Usage with asynchronous Django

As of now only Error403EmailsMiddleware can run asynchronously under ASGI. If you plan to use FailedLoginMiddleware and Error403EmailsMiddleware together make sure to place Error403EmailsMiddleware before (reading top to bottom) FailedLoginMiddleware:

MIDDLEWARE = [
"monitus.middleware.FailedLoginMiddleware",
"monitus.middleware.Error403EmailsMiddleware" # this should go before FailedLoginMiddleware
...
]

This way the async chain doesn't get broken when the response traverses the middleware chain to exit out to the user.

Development and testing

To test on your local machine with Postgres, make sure to have a role with enough privileges:

CREATE ROLE monitustestuser WITH LOGIN PASSWORD 'monitustestpassword' CREATEDB;

Then run

DATABASE_URL=postgres://monitustestuser:monitustestpassword@localhost/monitustestdb tox

django-monitus's Issues

FailedLoginMiddleware sends on GET and HEAD

FailedLoginMiddleware should not send emails on GET and HEAD requests. Found the reason: form.error_messages is always pre-populated. The middleware must send emails only if the auth form has errors.

Use locmem template loader in tests

Use locmem template loader in tests instead of files. See https://forum.djangoproject.com/t/using-a-string-as-template-in-cbv/5797/5

Failed login attempts

Implement a failed login attempts middleware.

Successful login middleware

Consider adding a Successful login middleware

Use override_settings

Use override_settings to enable only the necessary middlewares in testing.

AttributeError: 'AnonymousUser' object has no attribute 'email'

It should handle anonymous users.

If username is None use email

If username is None use the user email in error 403 middleware.

Error 400 middleware

Add an Error 400 middleware

KeyError: 'form'

Handle KeyError: 'form'

Async middlewares

Make the middlewares async capable.

Request info in email message

The email message in response to 403 should include:

• ip address
• username if available
• the path

FailedLoginMiddleware: Use invalid login string

Use invalid login string instead of checking against AuthenticationForm.

AttributeError: 'Some' object has no attribute 'error_messages'

The form in context_data does not have always an error_messages attribute. The middleware should trigger only for invalid logins, not for every form.

Test against Postgresql

Test against Postgresql to avoid concurrency issues with Sqlite in the future.