Django · Docs — BlockAlt

Template #

templates/signup.htmlHTML

{% load static %}
<script src="https://blockalt.click/v1/assets/blockalt.c8b2d9539dbbc932999adb0f51a36bddd4e99899f543e1505818841878cf9813.js"
  integrity="sha384-pblByFDqcJxRfhDh18GH3gRsWy9ZaS4AjDc6OpozzQqvkuYvyin+4BWcKXxA+bN8"
  crossorigin="anonymous"></script>
<script src="{% static 'js/signup.js' %}" defer></script>

<form id="signup" method="post">
  {% csrf_token %}
  {{ form }}
  <input name="blockalt-token" type="hidden">
  <button>Create account</button>
</form>

static/js/signup.jsJavaScript

const protection = BlockAlt.create({
  siteKey: "ba_pk_your_public_site_key",
  apiUrl: "https://blockalt.click",
  // Every key of GET /v1/keys (configPublicKeys), standby keys included.
  configPublicKeys: ["MCowBQYDK2VwAyEAXmYdcBh/jf+z+0H+hs2QvZ9UG4PBgkRvHX/JuXyjIL8=","MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE34qdEtOeD21+CmmfTmFyRr/vySsY1TD6BJZFtwF37pkelvN2vRYWWHdLrUouzkQXEfnA7V50xK2QcmnBCGsxbA==","MCowBQYDK2VwAyEAtkfghYcdvSRf2wA01gjQtgTqdYGjaDUZsOPXzgLnnT0=","MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYYmQNAMnVKK7G3VVguAk3SC/RFT5SDjCoxcFMOPFx0vmsGycJWOK8hCdxuTCHlvShng1fo0y4Q9PJHPIGQ9EfA=="],
});
const form = document.querySelector("#signup");
form.addEventListener("submit", async (event) => {
  event.preventDefault();
  try {
    // A fresh token for every attempt: single use, valid for 120 seconds.
    form.elements["blockalt-token"].value = await protection.execute("signup");
    form.submit();
  } catch {
    form.querySelector(".error").textContent = "Please try again.";
  }
});

Decorator #

Put verify_blockalt from the Python snippet in blockalt.py, then:

blockalt_django.pyPython

from functools import wraps

from django.http import HttpResponseForbidden

from .blockalt import verify_blockalt


def require_blockalt(action):
    def decorator(view):
        @wraps(view)
        def wrapped(request, *args, **kwargs):
            if request.method == "POST" and not verify_blockalt(
                request.POST.get("blockalt-token", ""), action
            ):
                return HttpResponseForbidden("Please try again.")
            return view(request, *args, **kwargs)

        return wrapped

    return decorator

views.pyPython

@require_blockalt("signup")
def signup(request):
    ...

With django-csp, add the CSP entries to CONTENT_SECURITY_POLICY.