3 |
3 |
4 |
5 | # Twilio Account Security Quickstart - Two-Factor Authentication and Phone Verification
6 |
7 | 
8 |
9 | > This template is part of Twilio CodeExchange. If you encounter any issues with this code, please open an issue at [github.com/twilio-labs/code-exchange/issues](https://github.com/twilio-labs/code-exchange/issues).
10 |
11 | ## About
12 |
13 | A simple Python and Django implementation of a website that uses Twilio Account Security services to protect all assets within a folder. Additionally, it shows a Phone Verification implementation.
14 |
15 | It uses four channels for delivery: SMS, Voice, Soft Tokens, and Push Notifications. You should have the [Authy App](https://authy.com/download/) installed to try Soft Token and Push Notification support.
16 |
17 | Learn more about Account Security and when to use the Authy API vs the Verify API in the [Account Security documentation](https://www.twilio.com/docs/verify/authy-vs-verify).
18 |
19 | Implementations in other languages:
20 |
21 | | .NET | Java | Node | PHP | Ruby |
22 | | :--- | :--- | :----- | :-- | :--- |
23 | | TBD | [Done](https://github.com/TwilioDevEd/account-security-quickstart-spring) | [Done](https://github.com/TwilioDevEd/account-security-quickstart-node) | [Done](https://github.com/TwilioDevEd/account-security-quickstart-php) | [Done](https://github.com/TwilioDevEd/account-security-quickstart-rails) |
24 |
25 | ## Features
26 |
27 | #### Two-Factor Authentication Demo
28 | - URL path "/protected" is protected with both user session and Twilio Two-Factor Authentication
29 | - One Time Passwords (SMS and Voice)
30 | - SoftTokens
31 | - Push Notifications (via polling)
32 |
33 | #### Phone Verification
34 | - Phone Verification
35 | - SMS or Voice Call
36 |
37 | ## Set up
38 |
39 | ### Requirements
40 | - This project only runs on Python 3.6+. In some environments when both version 2
41 | and 3 are installed, you may substitute the Python executables below with
42 | `python3` and `pip3` unless you use a version manager such as
43 | [pyenv](https://github.com/pyenv/pyenv).
44 |
45 | ### Twilio Account Settings
46 |
47 | This application should give you a ready-made starting point for writing your own application.
48 | Before we begin, we need to collect all the config values we need to run the application:
49 |
50 | | Config Value | Description |
51 | | :---------- | :---------- |
52 | | ACCOUNT_SECURITY_API_KEY | Create a new Authy application in the [console](https://www.twilio.com/console/authy/). After you give it a name you can view the generated Account Security production API key. This is the string you will later need to set up in your environmental variables.|
53 |
54 | 
55 |
56 | ### Local Development
57 |
58 | 1. Clone this repo and `cd` into it.
59 |
60 | ```bash
61 | git clone https://github.com/TwilioDevEd/account-security-quickstart-django.git
62 | cd account-security-quickstart-django
63 | ```
64 |
65 | 2. Create the virtual environment, load it and install dependencies.
66 |
67 | ```bash
68 | make install
69 | ```
70 |
71 | 3. Set your environment variables. Copy the `env.example` file and edit it.
72 |
73 | ```bash
74 | cp .env.example .env
75 | ```
76 |
77 | See [Twilio Account Settings](#twilio-account-settings) to locate the necessary environment variables.
78 |
79 | 4. Run migrations.
80 |
81 | ```bash
82 | make serve-setup
83 | ```
84 |
85 | 5. Start the development server. Before running the following command, make sure the virtual environment is activated.
86 |
87 | ```bash
88 | make serve
89 | ```
90 |
91 | 6. The application should now be running on http://localhost:8000/, here you can
92 | register a new user account and proceed with a phone verification.
93 |
94 | That's it!
95 |
96 | ### Docker
97 |
98 | If you have [Docker](https://www.docker.com/) already installed on your machine, you can use our `docker-compose.yml` to setup your project.
99 |
100 | 1. Make sure you have the project cloned.
101 | 2. Setup the `.env` file as outlined in the [Local Development](#local-development) steps.
102 | 3. Run `docker-compose up`.
103 |
104 | ### Tests
105 |
106 | You can run the tests locally by typing the following command, make sure the virtual environment is activated.
107 |
108 | ```bash
109 | python3 manage.py test
110 | ```
111 |
112 |
113 | ### Cloud deployment
114 |
115 | Additionally to trying out this application locally, you can deploy it to a variety of host services. Here is a small selection of them.
116 |
117 | Please be aware that some of these might charge you for the usage or might make the source code for this application visible to the public. When in doubt research the respective hosting service first.
118 |
119 | | Service | |
120 | | :-------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
121 | | [Heroku](https://www.heroku.com/) | [](https://heroku.com/deploy) |
122 |
123 | ## Resources
124 |
125 | - The CodeExchange repository can be found [here](https://github.com/twilio-labs/code-exchange/).
126 |
127 | ## Contributing
128 |
129 | This template is open source and welcomes contributions. All contributions are subject to our [Code of Conduct](https://github.com/twilio-labs/.github/blob/master/CODE_OF_CONDUCT.md).
130 |
131 | ## License
132 |
133 | [MIT](http://www.opensource.org/licenses/mit-license.html)
134 |
135 | ## Disclaimer
136 |
137 | No warranty expressed or implied. Software is as is.
138 |
139 | [twilio]: https://www.twilio.com
140 |
--------------------------------------------------------------------------------
/account_security/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TwilioDevEd/account-security-quickstart-django/e0c2b15e35beef640b31e1691d8f0d50eba26866/account_security/__init__.py
--------------------------------------------------------------------------------
/account_security/settings.py:
--------------------------------------------------------------------------------
1 | """
2 | Django settings for account_security project.
3 |
4 | Generated by 'django-admin startproject' using Django 1.11.6.
5 |
6 | For more information on this file, see
7 | https://docs.djangoproject.com/en/1.11/topics/settings/
8 |
9 | For the full list of settings and their values, see
10 | https://docs.djangoproject.com/en/1.11/ref/settings/
11 | """
12 |
13 | import os
14 | from dotenv import load_dotenv
15 |
16 | # Build paths inside the project like this: os.path.join(BASE_DIR, ...)
17 | BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
18 |
19 | load_dotenv(os.path.join(BASE_DIR, '.env'))
20 |
21 |
22 | # Quick-start development settings - unsuitable for production
23 | # See https://docs.djangoproject.com/en/1.11/howto/deployment/checklist/
24 |
25 | # SECURITY WARNING: keep the secret key used in production secret!
26 | SECRET_KEY = '!@v)i0w+*@ld2tsr#l-e6-zp$a(k*%qt68+ago0i(yn6z9g35_'
27 |
28 | # SECURITY WARNING: don't run with debug turned on in production!
29 | DEBUG = True
30 |
31 | ALLOWED_HOSTS = []
32 |
33 |
34 | # Application definition
35 |
36 | INSTALLED_APPS = [
37 | 'django.contrib.admin',
38 | 'django.contrib.auth',
39 | 'django.contrib.contenttypes',
40 | 'django.contrib.sessions',
41 | 'django.contrib.messages',
42 | 'django.contrib.staticfiles',
43 |
44 | 'twofa',
45 | 'phone_verification',
46 | 'clients'
47 | ]
48 |
49 | MIDDLEWARE = [
50 | 'django.middleware.security.SecurityMiddleware',
51 | 'django.contrib.sessions.middleware.SessionMiddleware',
52 | 'django.middleware.common.CommonMiddleware',
53 | 'django.middleware.csrf.CsrfViewMiddleware',
54 | 'django.contrib.auth.middleware.AuthenticationMiddleware',
55 | 'django.contrib.messages.middleware.MessageMiddleware',
56 | 'django.middleware.clickjacking.XFrameOptionsMiddleware',
57 | ]
58 |
59 | ROOT_URLCONF = 'account_security.urls'
60 |
61 | TEMPLATES = [
62 | {
63 | 'BACKEND': 'django.template.backends.django.DjangoTemplates',
64 | 'DIRS': [],
65 | 'APP_DIRS': True,
66 | 'OPTIONS': {
67 | 'context_processors': [
68 | 'django.template.context_processors.debug',
69 | 'django.template.context_processors.request',
70 | 'django.contrib.auth.context_processors.auth',
71 | 'django.contrib.messages.context_processors.messages',
72 | ],
73 | },
74 | },
75 | ]
76 |
77 | WSGI_APPLICATION = 'account_security.wsgi.application'
78 |
79 |
80 | # Database
81 | # https://docs.djangoproject.com/en/1.11/ref/settings/#databases
82 |
83 | DATABASES = {
84 | 'default': {
85 | 'ENGINE': 'django.db.backends.sqlite3',
86 | 'NAME': os.path.join(BASE_DIR, 'db.sqlite3'),
87 | }
88 | }
89 |
90 |
91 | # Password validation
92 | # https://docs.djangoproject.com/en/1.11/ref/settings/#auth-password-validators
93 |
94 | AUTH_PASSWORD_VALIDATORS = [
95 | {
96 | 'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
97 | },
98 | {
99 | 'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
100 | },
101 | {
102 | 'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
103 | },
104 | {
105 | 'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
106 | },
107 | ]
108 |
109 |
110 | # Internationalization
111 | # https://docs.djangoproject.com/en/1.11/topics/i18n/
112 |
113 | LANGUAGE_CODE = 'en-us'
114 |
115 | TIME_ZONE = 'UTC'
116 |
117 | USE_I18N = True
118 |
119 | USE_L10N = True
120 |
121 | USE_TZ = True
122 |
123 | LOGIN_URL = '/login/'
124 | LOGOUT_URL = '/logout/'
125 | LOGIN_REDIRECT_URL = '/protected/'
126 | LOGOUT_REDIRECT_URL = '/login/'
127 |
128 | # Static files (CSS, JavaScript, Images)
129 | # https://docs.djangoproject.com/en/1.11/howto/static-files/
130 |
131 | STATIC_URL = '/static/'
132 | STATIC_ROOT = os.path.join(BASE_DIR, 'static')
133 |
134 |
135 | # Use our custom User Model
136 | AUTH_USER_MODEL = 'twofa.TwoFAUser'
137 |
138 | # Authy Application Key
139 | ACCOUNT_SECURITY_API_KEY = os.environ.get('ACCOUNT_SECURITY_API_KEY')
140 | TWILIO_ACCOUNT_SID = os.environ.get('TWILIO_ACCOUNT_SID')
141 | TWILIO_AUTH_TOKEN = os.environ.get('TWILIO_AUTH_TOKEN')
142 | TWILIO_VERIFICATION_SID = os.environ.get('TWILIO_VERIFICATION_SID')
143 |
--------------------------------------------------------------------------------
/account_security/urls.py:
--------------------------------------------------------------------------------
1 | from django.conf import settings
2 | from django.urls import path
3 | from django.conf.urls.static import static
4 | from django.contrib.auth import views as auth_views
5 |
6 | from twofa import views as twofa_views
7 | from phone_verification import views as verify_views
8 |
9 | urlpatterns = [
10 | path('login/', auth_views.LoginView.as_view(), name='login'),
11 | path('logout/', auth_views.LogoutView.as_view(), name='logout'),
12 |
13 | path('register/', twofa_views.register, name='register'),
14 | path('2fa/', twofa_views.twofa, name='2fa'),
15 | path('token/sms', twofa_views.token_sms, name='token-sms'),
16 | path('token/voice', twofa_views.token_voice, name='token-voice'),
17 | path('token/onetouch', twofa_views.token_onetouch, name='token-onetouch'), # noqa: E501
18 | path('protected/', twofa_views.protected, name='protected'),
19 | path('onetouch-status', twofa_views.onetouch_status, name='onetouch-status'), # noqa: E501
20 |
21 | path('verification/', verify_views.phone_verification, name='phone_verification'), # noqa: E501
22 | path('verification/token/', verify_views.token_validation, name='token_validation'), # noqa: E501
23 | path('verified/', verify_views.verified, name='verified'),
24 |
25 | path('', twofa_views.home, name='home'),
26 | ] + static(settings.STATIC_URL, document_root=settings.STATIC_ROOT)
27 |
--------------------------------------------------------------------------------
/account_security/wsgi.py:
--------------------------------------------------------------------------------
1 | """
2 | WSGI config for account_security project.
3 |
4 | It exposes the WSGI callable as a module-level variable named ``application``.
5 |
6 | For more information on this file, see
7 | https://docs.djangoproject.com/en/1.11/howto/deployment/wsgi/
8 | """
9 |
10 | import os
11 |
12 | from django.core.wsgi import get_wsgi_application
13 |
14 | os.environ.setdefault("DJANGO_SETTINGS_MODULE", "account_security.settings")
15 |
16 | application = get_wsgi_application()
17 |
--------------------------------------------------------------------------------
/api_key.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TwilioDevEd/account-security-quickstart-django/e0c2b15e35beef640b31e1691d8f0d50eba26866/api_key.png
--------------------------------------------------------------------------------
/clients/twilio_client.py:
--------------------------------------------------------------------------------
1 | from twilio.rest import Client
2 | from django.conf import settings
3 |
4 | client = Client(settings.TWILIO_ACCOUNT_SID, settings.TWILIO_AUTH_TOKEN)
5 |
6 | def verifications(phone_number, via):
7 | return client.verify \
8 | .services(settings.TWILIO_VERIFICATION_SID) \
9 | .verifications \
10 | .create(to=phone_number, channel=via)
11 |
12 | def verification_checks(phone_number, token):
13 | return client.verify \
14 | .services(settings.TWILIO_VERIFICATION_SID) \
15 | .verification_checks \
16 | .create(to=phone_number, code=token)
17 |
--------------------------------------------------------------------------------
/docker-compose.yml:
--------------------------------------------------------------------------------
1 | version: "3.8"
2 | services:
3 | app:
4 | build: .
5 | ports:
6 | - "8000:8000"
--------------------------------------------------------------------------------
/manage.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 | import os
3 | import sys
4 |
5 | if __name__ == "__main__":
6 | os.environ.setdefault("DJANGO_SETTINGS_MODULE",
7 | "account_security.settings")
8 | try:
9 | from django.core.management import execute_from_command_line
10 | except ImportError:
11 | # The above import may fail for some other reason. Ensure that the
12 | # issue is really that Django is missing to avoid masking other
13 | # exceptions on Python 2.
14 | try:
15 | import django # noqa: F401
16 | except ImportError:
17 | raise ImportError(
18 | "Couldn't import Django. Are you sure it's installed and "
19 | "available on your PYTHONPATH environment variable? Did you "
20 | "forget to activate a virtual environment?"
21 | )
22 | raise
23 | execute_from_command_line(sys.argv)
24 |
--------------------------------------------------------------------------------
/phone_verification/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TwilioDevEd/account-security-quickstart-django/e0c2b15e35beef640b31e1691d8f0d50eba26866/phone_verification/__init__.py
--------------------------------------------------------------------------------
/phone_verification/apps.py:
--------------------------------------------------------------------------------
1 | from django.apps import AppConfig
2 |
3 |
4 | class PhoneVerificationConfig(AppConfig):
5 | name = 'phone_verification'
6 |
--------------------------------------------------------------------------------
/phone_verification/forms.py:
--------------------------------------------------------------------------------
1 | import phonenumbers
2 |
3 | from django import forms
4 | from phonenumbers import NumberParseException
5 | from twofa.forms import BootstrapInput
6 |
7 |
8 | class BootstrapSelect(forms.Select):
9 | def __init__(self, size=12, *args, **kwargs):
10 | self.size = size
11 | super(BootstrapSelect, self).__init__(attrs={
12 | 'class': 'form-control input-sm',
13 | })
14 |
15 | def bootwrap_input(self, input_tag):
16 | classes = 'col-xs-{n} col-sm-{n} col-md-{n}'.format(n=self.size)
17 |
18 | return '''14 | Congratulations. You have verified your Phone! 15 |
16 |14 | Implementations of both Verify Phone Verification and Authy Two-Factor Authentication 15 |
16 |14 | Congrats! You have successfully implemented Twilio Two-Factor Authentication. Browse the links below for more information related to Twilio Account Security. 15 |
16 | 17 |