django / django/new-features

[Management Commands] Add authenticated shell session

Open
#139 3 comments 3 reactions 0 assignees View on GitHub
Authentication/Users CLI / Management Commands
Dominant language
No language data
Stars
188
Forks
7
PR merge metrics
No merged PRs in 30d

Description

### Code of Conduct

- [x] I agree to follow Django's Code of Conduct

### Feature Description

1. Add a `manage.py login` command to set and reuse `_user` for the current session
2. Add a setting `SHELL_REQUIRES_AUTH` - Require a currently logged-in user to access the shell
3. Add a `requireAuth` check for management commands if you want to protect only a few commands

### Problem

Django Management commands are extremely useful tools; sometimes it's useful to run some one-off commands even in production. However, it is still arbitrary code executed during runtime.

Anyone with server access can run the commands. Having an authenticated shell and being able to limit the commands a user can run can allow for simpler federated perms within teams, and also in case a malicious actor gains access to the server (assuming they do not have write access)

### Request or proposal

request

### Additional Details

_No response_

### Implementation Suggestions

_No response_

Contributor guide

No contributing guide indexed for this repository

Research direction

No files, tests, or entry points are named in the proposal. Start by locating Django's management-command and shell entry points, then trace how the current user session is represented; done should cover the proposed login command, SHELL_REQUIRES_AUTH setting, and optional command-level authentication checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
django
Domain
authentication, cli, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.