Remove django-ipware

to reduce the risk of IP spoofing

Author: mjnaderi

CHANGELOG.md

@@ -1,6 +1,15 @@
 # Unreleased
 
-- Add support for Python 3.13.  
+- Add support for Python 3.13.
+- Remove **django-ipware** dependency to reduce the risk of IP spoofing.
+  (for the same reason Django
+  [removed](https://docs.djangoproject.com/en/5.2/releases/1.1/#removed-setremoteaddrfromforwardedfor-middleware)
+  `SetRemoteAddrFromForwardedFor` in 1.1).
+  The IP is now extracted directly from the `REMOTE_ADDR` header.
+  Instead of relying on **django-ipware**
+  to extract the IP address from the request,
+  you should configure your web server
+  to pass the real IP address in the `REMOTE_ADDR` header.
 
 # 1.1.5 (Jun 22, 2024)
 

README.md

@@ -209,18 +209,11 @@ Admin page:
 ### Caveats
 
 - `session.updated_at` is not the session's exact last activity. It's
-  updated each time the session object in DB is saved. (e.g. when user
+  updated each time the session object is saved in DB. (e.g. when user
   logs in, or when ip, user agent, or session data changes)
-
-## Why not `django-user-sessions`?
-
-[django-user-sessions](https://github.com/Bouke/django-user-sessions)
-has the same functionality, but only extends the `db` backend. Using a
-cache can improve performance.
-
-We got ideas and some codes from django-user-sessions. Many thanks to
-[Bouke Haarsma](https://github.com/Bouke) for writing
-django-user-sessions.
+- **django-qsessions** extracts IP directly from the `REMOTE_ADDR` header.
+  If you are using a reverse proxy, you need to configure it to pass the
+  real IP address in the `REMOTE_ADDR` header.
 
 ## Development
 

setup.py

@@ -28,7 +28,7 @@
     license="MIT",
     packages=find_packages(".", include=("qsessions", "qsessions.*")),
     include_package_data=True,
-    install_requires=["Django >= 3.2, != 4.1.0", "user-agents>=1.1.0", "django-ipware>=2.0.0"],
+    install_requires=["Django >= 4.2", "user-agents>=1.1.0"],
     extras_require={"dev": dev_requirements},
     tests_require=dev_requirements,
     classifiers=[