<p align="center">
<img src="https://banners.beyondco.de/Masonite%20Security.png?theme=light&packageManager=pip+install&packageName=masonite-security&pattern=charlieBrown&style=style_2&description=Secure+masonite+apps+from+spamming+Bots,+IP's+and+SQL+injections.&md=1&showWatermark=1&fontSize=100px&images=adjustments&widths=50&heights=50">
</p>

<p align="center">
  <a href="https://docs.masoniteproject.com">
    <img alt="Masonite Package" src="https://img.shields.io/static/v1?label=Masonite&message=package&labelColor=grey&color=blue&logo=data:image/png;base64, ">
  </a>
  <img alt="GitHub Workflow Status (branch)" src="https://img.shields.io/github/workflow/status/py-package/masonite-security/Test%20Application">
  <img alt="PyPI" src="https://img.shields.io/pypi/v/masonite-security">
  <img src="https://img.shields.io/badge/python-3.7+-blue.svg" alt="Python Version">
  <img alt="GitHub release (latest by date including pre-releases)" src="https://img.shields.io/github/v/release/py-package/masonite-security?include_prereleases">
  <img alt="License" src="https://img.shields.io/github/license/py-package/masonite-security">
  <a href="https://github.com/psf/black"><img alt="Code style: black" src="https://img.shields.io/badge/code%20style-black-000000.svg"></a>
</p>

# Masonite Security

Secure masonite apps from spamming Bots, IP's and SQL injections.

## Features

- [x] Block IP's
- [x] Block Bots
- [x] Throttle Requests
- [ ] Block SQL Injections

## Installation

```bash
pip install masonite-security
```

## Configuration

Add SecurityProvider to your project in `config/providers.py`:

```python
# config/providers.py
# ...
from security import SecurityProvider

# ...
PROVIDERS = [
    # ...
    # Third Party Providers
    SecurityProvider,
    # ...
]
```

Then you can publish the package resources by doing:

```bash
python craft package:publish security
```

## Register Middleware.

You can setup the security middleware globally or per route basis.

**Global Setup**

Open `Kernal.py` file and add `SecurityMiddleware` in "route_middleware" section:

```python
route_middleware = {
      "web": [SessionMiddleware, LoadUserMiddleware, VerifyCsrfToken, SecurityMiddleware],
      "auth": [AuthenticationMiddleware],
  }
```

**Per Route Setup**

In your routes add `protect` middleware like this:

```python
Route.get("/", "WelcomeController@show").middleware("protect")
```

## Configure Security Config

Update your `config/security.py` file based on your needs:

```python
# config/security.py
# ...
BLOCK_IP = True
BLOCK_BOTS = True
THROTTLE_REQUESTS = True

MAX_REQUESTS = 20 # Max requests per IP (default: 20)
IP_BLOCK_DURATION = 60  # seconds (default: 60)

# list of IP addresses to block (default: [])
BLOCKED_IPS = [
  #...
]

# list of Bot Agents to block
BLOCKED_BOTS = [
    #...
]
# ...
```

## Contributing

Please read the [Contributing Documentation](CONTRIBUTING.md) here.

## Maintainers

- [x] [Yubaraj Shrestha](https://www.github.com/py-package)

## License


security is open-sourced software licensed under the [MIT license](LICENSE).

