Django login with django-axes

Question

I created a site with django. Users must be able to log in. The input view is as follows:

from django.contrib.auth import authenticate, login from django.contrib.auth.models import User .... if request.method == 'POST': username = request.POST['username']#get username password = request.POST['txtPwd']# and password user = authenticate(username=username, password=password) #checking username and pwd if user is not None: if user.is_active: login(request, user) 

But with this "decision" I can not cope with brute force. So I looked around and found this: Malicious activity using attacks in Django

The first answer was helpful. I chose django-axes because django-ratelimit only considers amout of a view call.

But here is my problem: when I try to log in with the wrong password, this is not considered a failure. (Only in the / admin section).

I did not find the option to "add" my input type in the django-axis.

So here is my question:

How to configure django axes to handle failed logins from my login window?

EDIT: Here is my settings file:

 INSTALLED_APPS = ( 'django.contrib.admin', 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.messages', 'django.contrib.staticfiles', 'axes', ) MIDDLEWARE_CLASSES = ( 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'axes.middleware.FailedLoginMiddleware' ) ... AXES_LOCK_OUT_AT_FAILURE = False AXES_USE_USER_AGENT = True AXES_COOLOFF_TIME = 1 AXES_LOGIN_FAILURE_LIMIT = 50 

Answer 1

By default, django-axes django uses the django * login view ( django.contrib.auth.views.login ). In middleware, watch_login decorates this view.

Thus, you can solve your problem in two ways:

• Use the standard login form. Thus, django-axes does not require additional configuration.
• decorate your login view with watch_login decorator.

For example: views.py

 from axes.decorators import watch_login ... @watch_login def your_custom_login_view(request): ... 

It will then be used as follows in the class view, as mentioned by @Ali Faizan:

 @method_decorator(watch_login, name='dispatch') class your_custom_login_view(): ...