PyPI · #2897 most downloaded on PyPI

django-hijack

3.7.82.6M downloads/modjango-hijack/django-hijack ↗New releases in your daily digest, changelog included.

Enable users to hijack (=login as) and work on behalf of another user.

Last release 5 months ago
19 Apr 2026
Release timing varies
gaps range from 9 days to 5 months
Nearly every release is documented
notes for 56 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
13 years old
85 releases · first in 2013

Release timeline

85 releases since 2013

20132015201720192021

Releases

2.1.119 Apr 2016
Nothing published for this version
2.1.013 Apr 2016
Make hijacking via POST a default requirement
Make hijacking via POST a default requirement

Introduce a setting HIJACK_ALLOW_GET_REQUESTS

Move Django admin integration to a separate package as it depends on GET (https://github.com/arteria/django-hijack-admin)

If you currently use the admin integration, follow the instructions there when upgrading

The setting HIJACK_DISPLAY_ADMIN_BUTTON is not used anymore.

Pass request to signals

Tests for custom decorators
Open source →
2.0.86 Apr 2016
Fix end-of-hijack session cleanup code
Fix end-of-hijack session cleanup code

Don't save hijacked user at login; disconnect update_last_login instead

Avoid encoding error in setup.py

One column per quarter.

2.0.72 Mar 2016

Optional setting for admin hijack button template, cf. http://django-hijack.readthedocs.org/en/latest/configuration/#hijack_button_template

Optional setting for admin hijack button template, cf. http://django-hijack.readthedocs.org/en/latest/configuration/#hijack_button_template
Minor enhancements

Open source →

2.0.62 Mar 2016

Nothing published for this version

2.0.38 Jan 2016

Use pk to access the User primary key

Use pk to access the User primary key

Open source →

2.0.24 Jan 2016

Use pk to access the User primary key

Use pk to access the User primary key

Open source →

2.0.123 Dec 2015

Remove django-sessioninfo as a dependency

Remove django-sessioninfo as a dependency

Open source →

2.0.020 Nov 2015Deprecated

Unify settings; Django will show a warning if a deprecated setting name is used. See http://django-hijack.rtfd.org/en/latest/configuration/#settings-o…

Unify settings; Django will show a warning if a deprecated setting name is used. See http://django-hijack.rtfd.org/en/latest/configuration/#settings-overview
Drop official support for Django 1.4, 1.6; add support for 1.9 using https://github.com/arteria/django-compat v1.0.8
Add i18n support, see https://github.com/arteria/django-hijack/tree/v2.0.0/hijack/locale
Make HIJACK_DECORATOR configurable
Do not update last_login time of hijacked users
Add optional Bootstrap-optimized notification bar. Can be activated with HIJACK_USE_BOOTSTRAP
Add signals hijack_started and hijack_ended
Add AppConfig and various checks
Check "next" GET parameter for safety
Move documentation to http://django-hijack.readthedocs.org/
Use https://github.com/arteria/django-sessioninfo as a dependency
Rewrite tests

Open source →

1.0.109 Nov 2015

Allow hijacking users with negative IDs

Bugfixes
Allow hijacking users with negative IDs

Open source →

1.0.917 Aug 2015

allow email usernames in login_with_username

allow email usernames in login_with_username
dropped support for django 1.5

Open source →

1.0.810 Jun 2015Security

NOTE: Be careful using the new custom hijack function, this can cause serious security vulnerabilities!

Added RemoteUser support, for more information see the FAQ
Fixed hide button to redirects to correct full path
Custom hijack function

NOTE: Be careful using the new custom hijack function, this can cause serious security vulnerabilities!

Open source →

1.0.730 Apr 2015

Security update. We recommend you to update django-hijack to the latest version.

HTML tags, are now rendered with escaping

Open source →

1.0.610 Mar 2015

Do not allow staff users to hijack superusers

Do not allow staff users to hijack superusers
Add setting to choose which user attributes can be used for hijacking a user
Use a more liberal/naive approach to regex checking for an email
Code cleanup
Check staff status against logged in user instead the user being hijacked (bugfix)
Only include 'disable-hijack-warning' url if HIJACK_NOTIFY_ADMIN is enabled

Open source →

1.0.519 Feb 2015

Correct classifiers in setup.py

Fixed error in dependency
Correct classifiers in setup.py

Open source →

1.0.416 Feb 2015

Find django-hijack also on PyPI.

Python3 support
Travis CI Testing

Find django-hijack also on PyPI.

Open source →

1.0.34 Dec 2014

Nothing published for this version

1.0.228 Nov 2014

Nothing published for this version

1.0.12 Oct 2014

Nothing published for this version

1.0.03 Sept 2014

Nothing published for this version

0.1.45 Feb 2014

Nothing published for this version

0.1.322 Jan 2014

Nothing published for this version

0.1.219 Dec 2013

Nothing published for this version

0.1.11 Nov 2013

Nothing published for this version

0.114 Oct 2013

Nothing published for this version

Your coding agent can read these notes before it upgrades. Set up the MCP server →