Use ua-parser instead of user-agents

Author: mjnaderi

CHANGELOG.md

@@ -1,15 +1,26 @@
 # Unreleased
 
 - Add support for Python 3.13.
-- Remove **django-ipware** dependency to reduce the risk of IP spoofing.
-  (for the same reason Django
+
+Backward-incompatible changes:
+
+- The IP is now read directly from the value of `REMOTE_ADDR`
+  (instead of relying on **django-ipware**)
+  for the same reason Django
   [removed](https://docs.djangoproject.com/en/5.2/releases/1.1/#removed-setremoteaddrfromforwardedfor-middleware)
-  `SetRemoteAddrFromForwardedFor` in 1.1).
-  The IP is now extracted directly from the `REMOTE_ADDR` header.
-  Instead of relying on **django-ipware**
-  to extract the IP address from the request,
-  you should configure your web server
-  to pass the real IP address in the `REMOTE_ADDR` header.
+  `SetRemoteAddrFromForwardedFor` middleware in 1.1.
+  If you are using a reverse proxy,
+  you should configure it
+  to pass the real IP address in the `REMOTE_ADDR` header,
+  or you can write a custom version of
+  [`SetRemoteAddrFromForwardedFor` middleware](https://github.com/django/django/blob/91f18400cc0fb37659e2dbaab5484ff2081f1f30/django/middleware/http.py#L33)
+  which suits your environment.
+- `session.device` is now a property instead of a method and returns string.
+- The device object can be accessed using the new property `session.device_info`.
+- User agent parsing is now done using `ua-parser` instead of `user-agents`.
+  - The device object is now an instance of `ua_parser.core.Result`
+    instead of `user_agents.parsers.UserAgent`.
+
 
 # 1.1.5 (Jun 22, 2024)
 

README.md

@@ -180,14 +180,14 @@ Get IP and user agent:
 Get user device (parsed user-agent string):
 
 ```python
->>> str(session.device())
-'K / Android 10 / Chrome Mobile 118.0.0'
->>> session.device().device
+>>> session.device
+'K / Android 10 / Chrome Mobile 118.0.0.0'
+>>> session.device_info.device
 Device(family='K', brand='Generic_Android', model='K')
->>> session.device().os
-OperatingSystem(family='Android', version=(10,), version_string='10')
->>> session.device().browser
-Browser(family='Chrome Mobile', version=(118, 0, 0), version_string='118.0.0')
+>>> session.device_info.os
+OS(family='Android', major='10', minor=None, patch=None, patch_minor=None)
+>>> session.device_info.user_agent
+UserAgent(family='Chrome Mobile', major='118', minor='0', patch='0', patch_minor='0')
 ```
 
 
@@ -211,9 +211,15 @@ Admin page:
 - `session.updated_at` is not the session's exact last activity. It's
   updated each time the session object is saved in DB. (e.g. when user
   logs in, or when ip, user agent, or session data changes)
-- **django-qsessions** extracts IP directly from the `REMOTE_ADDR` header.
-  If you are using a reverse proxy, you need to configure it to pass the
-  real IP address in the `REMOTE_ADDR` header.
+- The IP address is directly read from `request.META["REMOTE_ADDR"]`.
+  If you are using a reverse proxy,
+  you should configure it
+  to pass the real IP address in the `REMOTE_ADDR` header.
+  You can also write a custom middleware
+  to set `REMOTE_ADDR` from the value of other headers
+  (`X-Forwarded-For`, `X-Real-IP`, ...)
+  in a safe way suitable for your environment.
+  More info: [Why Django removed SetRemoteAddrFromForwardedFor](https://docs.djangoproject.com/en/5.2/releases/1.1/#removed-setremoteaddrfromforwardedfor-middleware).
 
 ## Development
 

qsessions/models.py

@@ -1,3 +1,4 @@
+from functools import cached_property
 from importlib import import_module
 
 from django.conf import settings
@@ -70,13 +71,39 @@ def location(self):
     def location_info(self):
         return geoip.ip_to_location_info(self.ip)
 
-    def device(self):
+    @cached_property
+    def device_info(self):
         """
         Describe the user agent of this session, if any
-        :rtype: user_agents.parsers.UserAgent | None
+        :rtype: ua_parser.core.Result | None
         """
         if self.user_agent:
-            import user_agents  # late import to avoid import cost
+            from ua_parser import parse  # late import to avoid import cost
 
-            return user_agents.parse(self.user_agent)
+            return parse(self.user_agent)
         return None
+
+    @cached_property
+    def device(self) -> str:
+        if device := self.device_info:
+
+            def get_version_string(version_info):
+                try:
+                    return ".".join(version_info[: version_info.index(None)])
+                except ValueError:
+                    return ".".join(version_info)
+
+            return "{device} / {os} / {browser}".format(
+                device=device.device.family if device.device else "Other",
+                os=(
+                    f"{device.os.family} {get_version_string([device.os.major, device.os.minor, device.os.patch, device.os.patch_minor])}"
+                    if device.os
+                    else "Other"
+                ),
+                browser=(
+                    f"{device.user_agent.family} {get_version_string([device.user_agent.major, device.user_agent.minor, device.user_agent.patch, device.user_agent.patch_minor])}"
+                    if device.user_agent
+                    else "Other"
+                ),
+            )
+        return ""

setup.py

@@ -28,7 +28,7 @@
     license="MIT",
     packages=find_packages(".", include=("qsessions", "qsessions.*")),
     include_package_data=True,
-    install_requires=["Django >= 4.2", "user-agents>=1.1.0"],
+    install_requires=["Django >= 4.2", "ua-parser[regex] >= 1.0.1"],
     extras_require={"dev": dev_requirements},
     tests_require=dev_requirements,
     classifiers=[

tests/test_model.py

@@ -59,9 +59,9 @@ def test_device():
             "Chrome/70.0.3538.102 Safari/537.36"
         )
     )
-    device = session.device()
+    device = session.device_info
     assert device.os.family == "Mac OS X"
-    assert device.browser.family == "Chrome"
+    assert device.user_agent.family == "Chrome"
 
 
 @pytest.mark.django_db