
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
django-salesforce-oauth
Advanced tools
Simple package for creating and signing users into your Django site using Salesforce as an OAuth provider
Assuming you've already configured an app in your Salesforce instance to serve as an OAuth provider, the following should get you up and running.
pip install django-salesforce-oauth
Add the app to your INSTALLED_APPS
in your django settings (settings.py
):
INSTALLED_APPS = [
# ...
"django_salesforce_oauth",
]
Add the following required variables to your settings.py
:
SCOPES = "YOUR SCOPES" # space delimited, e.g., "id api refresh_token"
SFDC_CONSUMER_KEY = "YOUR KEY"
SFDC_CONSUMER_SECRET = "YOUR SECRET"
OAUTH_REDIRECT_URI = "{YOUR DOMAIN}/oauth/callback/"
# Optional, but Django provides a default you likely don't want
LOGIN_REDIRECT_URL = "/"
Add django-salesforce-oauth
's urls to your main urls.py
.
from django.urls import path, include
urlpatterns = [
# ...
path("oauth/", include("django_salesforce_oauth.urls")),
]
Then redirect sign-in requests to the oauth
namespace.
from django.shortcuts import redirect
def your_view(request):
return redirect("oauth") # or "oauth-sandbox"
<a href="{% url 'oauth' %}" class="btn btn-primary">Login</a>
You likely will want to customize what happens after the OAuth flow is complete instead of simply
getting or creating a user. This can be done by specifying the following in your settings.py
.
CUSTOM_CALLBACK = "path.to.module.your_callback_function"
your_callback_function
must accept the following two arguments:
If you send the user to the oauth
view with a query parameter called state
, then you must
provide a third, optional argument to your custom callback function.
oauth
with ?state=value
in your
query params.An example signature is:
def your_callback_function(request, oauth, state=None):
...
If you do not return a redirect from your_callback_function
, it's expected it will return
a user object. In this case the user will then be signed in and redirected to
settings.LOGIN_REDIRECT_URL
(which you'll most likely want to set in your settings.py
).
By default the view behind the oauth-callback
namespace, specified in the django_salesforce_oauth
's app's urls.py
, is what needs to match settings.OAUTH_REDIRECT_URI
.
But this can be customized by pointing it to some other url and registering the view wherever
you'd like it declared.
# urls.py
from django_salesforce_oauth.views import oauth_callback
urlpatterns = [
# ...
# pass {"domain": "test"} to use a sandbox
path("my/custom/url", oauth_callback, {"domain": "login"}, name="custom-oauth-callback"),
]
The example project provides a full example of how to use this package, but since it's an integration, there's a few steps to actually running it.
Configure a SFDC OAuth app with which you can OAuth against.
Place a .env
file inside the project
folder that contains the following keys
from the OAuth app you configured above:
SFDC_CONSUMER_KEY=some_key
SFDC_CONSUMER_SECRET=secret_stuff
run migrations and start the server!
This project uses poetry for dependency management and packaging.
FAQs
Simple package for creating and signing users into your Django site using Salesforce as an OAuth provider
We found that django-salesforce-oauth demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.