Install & Compatibility
Where this runs
tested against v3.2.3 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.940 runs
installs and imports cleanly · install 0.0s · import 0.000s · 67.4MB
glibcpy 3.10–3.940 runs
installs and imports cleanly · install 3.5s · import 0.000s · 68MB
67MB installed
● package 67MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
get_query_string
✓ from sesame.utils import get_query_string
✗ from sesame.utils import get_query_string
To quickly integrate `django-sesame`, first configure your Django `settings.py` by adding `sesame.backends.ModelBackend` to `AUTHENTICATION_BACKENDS`. Then, define a URL route for `sesame.views.LoginView` in your `urls.py`. You can then generate magic links using `sesame.utils.get_query_string(user)` and send them to users. Visiting this link will log the user in. You can also configure `SESAME_MAX_AGE` for token lifetime and mark user passwords as unusable if they'll only use magic links.
import os
from django.contrib.auth import get_user_model
from django.urls import path
from sesame.views import LoginView
from sesame.utils import get_query_string
# --- Django settings.py (example additions) ---
# AUTHENTICATION_BACKENDS = [
# 'django.contrib.auth.backends.ModelBackend',
# 'sesame.backends.ModelBackend',
# ]
# # Optional: Configure token lifetime (e.g., 10 minutes for login by email)
# import datetime
# SESAME_MAX_AGE = datetime.timedelta(minutes=10)
# --- Your app's urls.py (example) ---
urlpatterns = [
path("sesame/login/", LoginView.as_view(), name="sesame-login"),
]
# --- Example usage in a view or script ---
User = get_user_model()
# Create or get a user (e.g., for 'jane.doe@example.com')
try:
user = User.objects.get(email="jane.doe@example.com")
except User.DoesNotExist:
user = User.objects.create_user("jane.doe", "jane.doe@example.com", "password123")
user.set_unusable_password() # If only using magic links, make password unusable
user.save()
# Assuming a base URL like 'http://127.0.0.1:8000'
base_url = os.environ.get('DJANGO_BASE_URL', 'http://127.0.0.1:8000')
login_path = '/sesame/login/'
# Generate a magic link
magic_link = base_url + login_path + get_query_string(user)
print(f"Magic link for {user.email}: {magic_link}")
# To test, manually visit this link in a browser while logged out.
Debug
Known issues
breakingChanging most Django Sesame settings (e.g., `SECRET_KEY`, `SESAME_TOKEN_NAME`, `SESAME_TOKENS`) will invalidate all previously generated authentication tokens.fixConfigure all Django Sesame settings carefully before generating tokens in a production environment. If settings must change, regenerate and redistribute new tokens.
affects: All versions
breakingUpgrading Django versions can invalidate existing magic links/tokens, particularly long-lived ones. This is because Django's password hashers increase their work factor with new releases, making a password hash upgrade indistinguishable from a password change to `django-sesame`.fixAfter a Django upgrade, regenerate and redistribute new tokens. Alternatively, for long-lived tokens, consider setting `SESAME_INVALIDATE_ON_PASSWORD_CHANGE = False` in `settings.py`, but be aware of the security implications.
affects: All versions, especially when upgrading Django (e.g., 4.x to 5.x, 5.x to 6.x)
gotchaOne-time tokens (`SESAME_ONE_TIME = True`) can fail if sent via email, as email providers often fetch links for previews or security scans, consuming the token before the actual user clicks it.fixInstead of `SESAME_ONE_TIME`, consider using a short `SESAME_MAX_AGE` (e.g., 5-10 minutes) for login-by-email scenarios to balance security and usability.
affects: All versions
gotchaSafari's 'Protection Against First Party Bounce Trackers' can cause issues (clearing cookies, logging out users) when `django-sesame` redirects after successful authentication.fixInstall the `ua-parser` package (`pip install ua-parser`). `django-sesame` will then use it to detect Safari and avoid the problematic redirect.
affects: All versions
gotchaThe primary keys of users are stored in clear text within tokens. While this is not inherently a security flaw if the token is secure, it's a privacy consideration.fixIf this is a concern, consider customizing primary keys or carefully review the use case for magic links.
affects: All versions
Upgrade
Version history
3.2.3latest on PyPI · released May 2, 2025
Audit
Dependencies
DjangorequiredCore framework requirement, integrates with django.contrib.auth.
ua-parseroptionalOptional: Mitigates Safari's 'Protection Against First Party Bounce Trackers' by detecting the browser.