requests-http-signature 0.5.0

Installation

$ pip install requests-http-signature

Usage

import requests
from requests_http_signature import HTTPSignatureAuth, algorithms

preshared_key_id = 'squirrel'
preshared_secret = b'monorail_cat'
url = 'http://example.com/path'

auth = HTTPSignatureAuth(key=preshared_secret, key_id=preshared_key_id, signature_algorithm=algorithms.HMAC_SHA256)
requests.get(url, auth=auth)

By default, only the Date header and the @method, @authority, and @target-uri derived component identifiers are signed for body-less requests such as GET. The Date header is set if it is absent. In addition, for requests with bodies (such as POST), the Content-Digest header is set to the SHA256 of the request body using the format described in the IETF Digest Fields draft RFC and signed. To add other headers to the signature, pass an array of header names in the covered_component_ids keyword argument.

In addition to signing messages in the client, the class method HTTPSignatureAuth.verify() can be used to verify incoming requests:

class key_resolver:
    def resolve_public_key(self, key_id):
        assert key_id == 'squirrel'
        return 'monorail_cat'

HTTPSignatureAuth.verify(request, signature_algorithm=algorithms.HMAC_SHA256, key_resolver=key_resolver)

See the API documentation for full details.

with open('key.pem', 'rb') as fh:
    auth = HTTPSignatureAuth(algorithm=algorithms.RSA_V1_5_SHA256, key=fh.read(), key_id=preshared_key_id)
requests.get(url, auth=auth)

class MyKeyResolver:
    def resolve_public_key(self, key_id: str):
        return public_key_pem_bytes[key_id]

    def resolve_private_key(self, key_id: str):
        return private_key_pem_bytes[key_id]

auth = HTTPSignatureAuth(algorithm=algorithms.RSA_V1_5_SHA256, key=fh.read(), key_resolver=MyKeyResolver())
requests.get(url, auth=auth)

Links

• Project home page (GitHub)

• Package documentation

• Package distribution (PyPI)

• Change log

• http-message-signatures - a dependency of this library that handles much of the implementation

• IETF HTTP Signatures draft

License

Licensed under the terms of the Apache License, Version 2.0.