Skip to main content

Python library for the Verified Email Protocol

Project description

This is a python client library for the Verified Email Protocol, a.k.a Mozilla’s BrowserID project. See here for details:

And see here for how to integrate it into your website:

For the vast majority of deployments, you will simply want to call the “verify” functon to verify a given assertion:

>>> data = vep.verify(BROWSERIDASSERTION, "")
>>> print data["email"]

The precise implementation of this function will change depending on the current recommendedations of the BrowserID team. Currently it POSTs the assertion to the remote verifier services on

For improved performance, or if you just want to live on the bleeding edge, you can explicitly perform verification locally like so:

>>> data = vep.verify_local(BROWSERIDASSERTION, "")
>>> print data["email"]

Note that the details of the Verified Email Protocol are still in flux, so local verification might break due to incompatible changes. As things stabilise this will become the default implementation.

If you have specialised needs, you can also create a “verifier” class to encapsulate any custom settings you may require. For example, here is how to do remote verification using a custom url-opening function:

>>> verifier = vep.RemoteVerifier(urlopen=my_urlopen_func)
>>> data = verifier.verify_local(BROWSERIDASSERTION, "")
>>> print data["email"]

0.3.0 - 2012-01-06

  • Support the “new-style” VEP assertion format. This avoids double-b64- encoding and generally results in smaller assertions.
  • Warn rather than fail if we can’t find the CA certificates. This will help new users get up and running more easily.
  • Add shortcut functions for verification with the default options. They are vep.verify(), vep.verify_remote(), vep.verify_local(), and vep.verify_dummy().
  • Add vep.utils.get_assertion_info(), which parses useful information out of an assertion without actually verifying it.
  • Make LocalVerifier expire cached public keys after 6 hours by default.
  • Allow LocalVerifier to take a user-specified cache object so that public keys can be stored in e.g. memcached.
  • Update to the latest issuer-key-fetch protocol (using /.well-known/vep).
  • Add InvalidIssuerError to report on invalid or untrusted issuers.
  • Clean up the internal JWT interface. It now uses module-level functions rather than classmethods.

0.2.1 - 2011-12-16

  • Use M2Crypto for faster DSA operations.
  • DummyVerifier: fix hex formatting for compatability with jwcrypto.
  • DummyVerifier: don’t emit FutureWarning on initialisation.

0.2.0 - 2011-12-07

  • do more validation of the assertion before checking the certificates, to avoid expensive crypto ops for things we know to be invalid.
  • implement DummyVerifier class to aid in testing, both of this package and of packages that are using PyVEP.
  • add exception hierarchy in vep.errors, so that calling code can easily tell why verification failed.

0.1.1 - 2011-12-01

  • add “” to default list of trusted secondaries.
  • implement additional signature algorithms.
  • if “hostname/.well-known/host-meta” gives a 404, fall back to “hostname/pk” to find the public key.

0.1.0 - 2011-11-23

  • initial release.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for PyVEP, version 0.3.0
Filename, size File type Python version Upload date Hashes
Filename, size PyVEP-0.3.0.tar.gz (31.2 kB) File type Source Python version None Upload date Hashes View

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring DigiCert DigiCert EV certificate Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page