Registry / web-framework / django-sesame

django-sesame

JSON →
library3.2.3pypypiunverified

Django Sesame provides frictionless authentication for your Django project using "Magic Links". It generates URLs with embedded authentication tokens, allowing users to log in or access specific content without passwords or traditional sessions. The library supports various token-based authentication use cases and is actively maintained, with current version 3.2.3 compatible with recent Django and Python versions.

pip install django-sesame
INSTALL
IMPORT
SIG · DJANGO-SESAME
D
django-sesame
web-frameworkpythonv3.2.3
Install
3.5s avg
Import
—
Disk
67MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.9–3.13
musl
3.9–3.13
Install & Compatibility
Where this runs
tested against v3.2.3 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.10–3.940 runs
installs and imports cleanly · install 0.0s · import 0.000s · 67.4MB
glibc
py 3.10–3.940 runs
installs and imports cleanly · install 3.5s · import 0.000s · 68MB
67MB installed
● package 67MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

get_query_string
✓ from sesame.utils import get_query_string
✗ from sesame.utils import get_query_string

To quickly integrate `django-sesame`, first configure your Django `settings.py` by adding `sesame.backends.ModelBackend` to `AUTHENTICATION_BACKENDS`. Then, define a URL route for `sesame.views.LoginView` in your `urls.py`. You can then generate magic links using `sesame.utils.get_query_string(user)` and send them to users. Visiting this link will log the user in. You can also configure `SESAME_MAX_AGE` for token lifetime and mark user passwords as unusable if they'll only use magic links.

import os from django.contrib.auth import get_user_model from django.urls import path from sesame.views import LoginView from sesame.utils import get_query_string # --- Django settings.py (example additions) --- # AUTHENTICATION_BACKENDS = [ # 'django.contrib.auth.backends.ModelBackend', # 'sesame.backends.ModelBackend', # ] # # Optional: Configure token lifetime (e.g., 10 minutes for login by email) # import datetime # SESAME_MAX_AGE = datetime.timedelta(minutes=10) # --- Your app's urls.py (example) --- urlpatterns = [ path("sesame/login/", LoginView.as_view(), name="sesame-login"), ] # --- Example usage in a view or script --- User = get_user_model() # Create or get a user (e.g., for 'jane.doe@example.com') try: user = User.objects.get(email="jane.doe@example.com") except User.DoesNotExist: user = User.objects.create_user("jane.doe", "jane.doe@example.com", "password123") user.set_unusable_password() # If only using magic links, make password unusable user.save() # Assuming a base URL like 'http://127.0.0.1:8000' base_url = os.environ.get('DJANGO_BASE_URL', 'http://127.0.0.1:8000') login_path = '/sesame/login/' # Generate a magic link magic_link = base_url + login_path + get_query_string(user) print(f"Magic link for {user.email}: {magic_link}") # To test, manually visit this link in a browser while logged out.
Debug
Known issues
breakingChanging most Django Sesame settings (e.g., `SECRET_KEY`, `SESAME_TOKEN_NAME`, `SESAME_TOKENS`) will invalidate all previously generated authentication tokens.
fix
Configure all Django Sesame settings carefully before generating tokens in a production environment. If settings must change, regenerate and redistribute new tokens.
affects: All versions
breakingUpgrading Django versions can invalidate existing magic links/tokens, particularly long-lived ones. This is because Django's password hashers increase their work factor with new releases, making a password hash upgrade indistinguishable from a password change to `django-sesame`.
fix
After a Django upgrade, regenerate and redistribute new tokens. Alternatively, for long-lived tokens, consider setting `SESAME_INVALIDATE_ON_PASSWORD_CHANGE = False` in `settings.py`, but be aware of the security implications.
affects: All versions, especially when upgrading Django (e.g., 4.x to 5.x, 5.x to 6.x)
gotchaOne-time tokens (`SESAME_ONE_TIME = True`) can fail if sent via email, as email providers often fetch links for previews or security scans, consuming the token before the actual user clicks it.
fix
Instead of `SESAME_ONE_TIME`, consider using a short `SESAME_MAX_AGE` (e.g., 5-10 minutes) for login-by-email scenarios to balance security and usability.
affects: All versions
gotchaSafari's 'Protection Against First Party Bounce Trackers' can cause issues (clearing cookies, logging out users) when `django-sesame` redirects after successful authentication.
fix
Install the `ua-parser` package (`pip install ua-parser`). `django-sesame` will then use it to detect Safari and avoid the problematic redirect.
affects: All versions
gotchaThe primary keys of users are stored in clear text within tokens. While this is not inherently a security flaw if the token is secure, it's a privacy consideration.
fix
If this is a concern, consider customizing primary keys or carefully review the use case for magic links.
affects: All versions
Upgrade
Version history
3.2.3latest on PyPI · released May 2, 2025
Audit
Dependencies
DjangorequiredCore framework requirement, integrates with django.contrib.auth.
ua-parseroptionalOptional: Mitigates Safari's 'Protection Against First Party Bounce Trackers' by detecting the browser.
Agent activity
27 hits · last 30 days
node
26
OpenAI (training)
1
Resources
django-sesame — pip install django-sesame · libregistry