{"id":8116,"library":"django-sesame","title":"Django Sesame","description":"Django Sesame provides frictionless authentication for your Django project using \"Magic Links\". It generates URLs with embedded authentication tokens, allowing users to log in or access specific content without passwords or traditional sessions. The library supports various token-based authentication use cases and is actively maintained, with current version 3.2.3 compatible with recent Django and Python versions.","status":"active","version":"3.2.3","language":"python","source_language":"en","source_url":"https://github.com/aaugustin/django-sesame","tags":["django","authentication","magic-links","passwordless","token-based"],"install":[{"cmd":"pip install django-sesame","lang":"bash","label":"Basic Installation"},{"cmd":"pip install django-sesame[ua]","lang":"bash","label":"With User-Agent Parsing (for Safari)"}],"dependencies":[{"reason":"Core framework requirement, integrates with django.contrib.auth.","package":"Django"},{"reason":"Optional: Mitigates Safari's 'Protection Against First Party Bounce Trackers' by detecting the browser.","package":"ua-parser","optional":true}],"imports":[{"wrong":"from sesame.utils import get_query_string","symbol":"get_query_string","correct":"from sesame.utils import get_query_string"}],"quickstart":{"code":"import os\nfrom django.contrib.auth import get_user_model\nfrom django.urls import path\nfrom sesame.views import LoginView\nfrom sesame.utils import get_query_string\n\n# --- Django settings.py (example additions) ---\n# AUTHENTICATION_BACKENDS = [\n#     'django.contrib.auth.backends.ModelBackend',\n#     'sesame.backends.ModelBackend',\n# ]\n# # Optional: Configure token lifetime (e.g., 10 minutes for login by email)\n# import datetime\n# SESAME_MAX_AGE = datetime.timedelta(minutes=10)\n\n# --- Your app's urls.py (example) ---\nurlpatterns = [\n    path(\"sesame/login/\", LoginView.as_view(), name=\"sesame-login\"),\n]\n\n# --- Example usage in a view or script ---\nUser = get_user_model()\n\n# Create or get a user (e.g., for 'jane.doe@example.com')\ntry:\n    user = User.objects.get(email=\"jane.doe@example.com\")\nexcept User.DoesNotExist:\n    user = User.objects.create_user(\"jane.doe\", \"jane.doe@example.com\", \"password123\")\n    user.set_unusable_password() # If only using magic links, make password unusable\n    user.save()\n\n# Assuming a base URL like 'http://127.0.0.1:8000'\nbase_url = os.environ.get('DJANGO_BASE_URL', 'http://127.0.0.1:8000')\nlogin_path = '/sesame/login/'\n\n# Generate a magic link\nmagic_link = base_url + login_path + get_query_string(user)\n\nprint(f\"Magic link for {user.email}: {magic_link}\")\n\n# To test, manually visit this link in a browser while logged out.","lang":"python","description":"To quickly integrate `django-sesame`, first configure your Django `settings.py` by adding `sesame.backends.ModelBackend` to `AUTHENTICATION_BACKENDS`. Then, define a URL route for `sesame.views.LoginView` in your `urls.py`. You can then generate magic links using `sesame.utils.get_query_string(user)` and send them to users. Visiting this link will log the user in. You can also configure `SESAME_MAX_AGE` for token lifetime and mark user passwords as unusable if they'll only use magic links."},"warnings":[{"fix":"Configure all Django Sesame settings carefully before generating tokens in a production environment. If settings must change, regenerate and redistribute new tokens.","message":"Changing most Django Sesame settings (e.g., `SECRET_KEY`, `SESAME_TOKEN_NAME`, `SESAME_TOKENS`) will invalidate all previously generated authentication tokens.","severity":"breaking","affected_versions":"All versions"},{"fix":"After a Django upgrade, regenerate and redistribute new tokens. Alternatively, for long-lived tokens, consider setting `SESAME_INVALIDATE_ON_PASSWORD_CHANGE = False` in `settings.py`, but be aware of the security implications.","message":"Upgrading Django versions can invalidate existing magic links/tokens, particularly long-lived ones. This is because Django's password hashers increase their work factor with new releases, making a password hash upgrade indistinguishable from a password change to `django-sesame`.","severity":"breaking","affected_versions":"All versions, especially when upgrading Django (e.g., 4.x to 5.x, 5.x to 6.x)"},{"fix":"Instead of `SESAME_ONE_TIME`, consider using a short `SESAME_MAX_AGE` (e.g., 5-10 minutes) for login-by-email scenarios to balance security and usability.","message":"One-time tokens (`SESAME_ONE_TIME = True`) can fail if sent via email, as email providers often fetch links for previews or security scans, consuming the token before the actual user clicks it.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Install the `ua-parser` package (`pip install ua-parser`). `django-sesame` will then use it to detect Safari and avoid the problematic redirect.","message":"Safari's 'Protection Against First Party Bounce Trackers' can cause issues (clearing cookies, logging out users) when `django-sesame` redirects after successful authentication.","severity":"gotcha","affected_versions":"All versions"},{"fix":"If this is a concern, consider customizing primary keys or carefully review the use case for magic links.","message":"The primary keys of users are stored in clear text within tokens. While this is not inherently a security flaw if the token is secure, it's a privacy consideration.","severity":"gotcha","affected_versions":"All versions"}],"env_vars":null,"search_vec":"'3.2.3':53 'access':28 'activ':48 'allow':22 'authent':7,20,43,62 'base':42,69 'case':45 'compat':54 'content':30 'current':51 'django':1,3,10,57,61 'embed':19 'frictionless':6 'generat':16 'librari':37 'link':14,65 'log':25 'magic':13,64 'magic-link':63 'maintain':49 'password':32 'passwordless':66 'project':11 'provid':5 'python':59 'recent':56 'sesam':2,4 'session':35 'specif':29 'support':38 'token':21,41,68 'token-bas':40,67 'tradit':34 'url':17 'use':12,44 'user':23 'various':39 'version':52,60 'without':31","created_at":"2026-04-16T17:00:31.486535+00:00","updated_at":"2026-04-16T17:00:31.486535+00:00","problems":{"verify_error":"Traceback (most recent call last):\n  File \"<string>\", line 1, in <module>\n  File \"/tmp/tmpmkv0u632/venv/lib/python3.12/site-packages/sesame/utils.py\", line 6, in <module>\n    from . import settings\n  File \"/tmp/tmpmkv0u632/venv/lib/python3.12/site-packages/sesame/settings.py\", line 92, in <module>\n "},"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"3.2.3","cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/aaugustin/django-sesame","docs":"https://django-sesame.readthedocs.io/","changelog":null,"pypi":"https://pypi.org/project/django-sesame/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["web-framework","auth-security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"import_fail","verified_at":"2026-07-03","last_verified":"2026-07-03","next_check":"2026-07-10","install_tag":null}}