requests-http-signature 0.2.0

Installation

$ pip install requests-http-signature

Usage

import requests
from requests_http_signature import HTTPSignatureAuth

preshared_key_id = 'squirrel'
preshared_secret = 'monorail_cat'
url = 'http://example.com/path'

requests.get(url, auth=HTTPSignatureAuth(key=preshared_secret, key_id=preshared_key_id))

By default, only the Date header is signed (as per the RFC) for body-less requests such as GET. The Date header is set if it is absent. In addition, for requests with bodies (such as POST), the Digest header is set to the SHA256 of the request body and signed (an example of this appears in the RFC). To add other headers to the signature, pass an array of header names in the headers keyword argument.

In addition to signing messages in the client, the class method HTTPSignatureAuth.verify() can be used to verify incoming requests:

def key_resolver(key_id, algorithm):
    return 'monorail_cat'

HTTPSignatureAuth.verify(request, key_resolver=key_resolver)

with open('key.pem', 'rb') as fh:
    requests.get(url, auth=HTTPSignatureAuth(algorithm="rsa-sha256", key=fh.read(), key_id=preshared_key_id))

Links

• IETF HTTP Signatures draft

• https://github.com/joyent/node-http-signature

• Project home page (GitHub)

• Documentation (Read the Docs)

• Package distribution (PyPI)

• Change log

License

Licensed under the terms of the Apache License, Version 2.0.