Skip to main content

Asymmetric key based authentication for HTTP APIs

Project description

https://img.shields.io/pypi/v/asymmetric_jwt_auth.svg https://gitlab.com/crgwbr/asymmetric_jwt_auth/badges/master/pipeline.svg https://gitlab.com/crgwbr/asymmetric_jwt_auth/badges/master/coverage.svg

What?

This is an library designed to handle authentication in server-to-server API requests. It accomplishes this using RSA public / private key pairs.

Why?

The standard pattern of using username and password works well for user-to-server requests, but is lacking for server-to-server applications. In these scenarios, since the password doesn’t need to be memorable by a user, we can use something far more secure: asymmetric key cryptography. This has the advantage that a password is never actually sent to the server.

How?

A public / private key pair is generated by the client machine. The server machine is then supplied with the public key, which it can store in any method it likes. When this library is used with Django, it provides a model for storing public keys associated with built-in User objects. When a request is made, the client creates a JWT including several claims and signs it using it’s private key. Upon receipt, the server verifies the claim to using the public key to ensure the issuer is legitimately who they claim to be.

The claim (issued by the client) includes components: the username of the user who is attempting authentication, the current unix timestamp, and a randomly generated nonce. For example:

{
    "username": "guido",
    "time": 1439216312,
    "nonce": "1"
}

The timestamp must be within ±20 seconds of the server time and the nonce must be unique within the given timestamp and user. In other words, if more than one request from a user is made within the same second, the nonce must change. Due to these two factors no token is usable more than once, thereby preventing replay attacks.

To make an authenticated request, the client must generate a JWT following the above format and include it as the HTTP Authorization header in the following format:

Authorization: JWT <my_token>

Important note: the claim is not encrypted, only signed. Additionally, the signature only prevents the claim from being tampered with or re-used. Every other part of the request is still vulnerable to tamper. Therefore, this is not a replacement for using SSL in the transport layer.

Full Documentation: https://asymmetric-jwt-auth.readthedocs.io

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

asymmetric_jwt_auth-1.0.1b5.tar.gz (23.5 kB view details)

Uploaded Source

Built Distribution

asymmetric_jwt_auth-1.0.1b5-py3-none-any.whl (34.0 kB view details)

Uploaded Python 3

File details

Details for the file asymmetric_jwt_auth-1.0.1b5.tar.gz.

File metadata

  • Download URL: asymmetric_jwt_auth-1.0.1b5.tar.gz
  • Upload date:
  • Size: 23.5 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/5.0.0 CPython/3.11.9

File hashes

Hashes for asymmetric_jwt_auth-1.0.1b5.tar.gz
Algorithm Hash digest
SHA256 35c082def2f3418d3bee92ada16db57b322017ba0d7496218a4e9a735d1a4e16
MD5 65ee9369c8764d1e179af434ad2bcd81
BLAKE2b-256 d9f35c0258ccb47024361cea42d29a838400f20615e35380b8ec8cbd310a5ade

See more details on using hashes here.

Provenance

File details

Details for the file asymmetric_jwt_auth-1.0.1b5-py3-none-any.whl.

File metadata

File hashes

Hashes for asymmetric_jwt_auth-1.0.1b5-py3-none-any.whl
Algorithm Hash digest
SHA256 92f86bb4eb2bc9712dd04bce1cac4fe069c4aebcb392b7ecfc3545d4253e5bef
MD5 fb6afa46eff1b852d8f401d1a0c4dfb8
BLAKE2b-256 cd3c2e9ad3f7ed0534ad1c3790e2f356d43278fa3681beb56f85034079629394

See more details on using hashes here.

Provenance

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page