http-message-signatures

http-message-signatures is an implementation of the IETF HTTP Message Signatures draft standard in Python.

Installation

pip3 install http-message-signatures

Synopsis

from http_message_signatures import HTTPMessageSigner, HTTPMessageVerifier, HTTPSignatureKeyResolver, algorithms
import requests, base64, hashlib, http_sfv

class MyHTTPSignatureKeyResolver(HTTPSignatureKeyResolver):
    keys = {"my-key": b"top-secret-key"}

    def resolve_public_key(self, key_id: str):
        return self.keys[key_id]

    def resolve_private_key(self, key_id: str):
        return self.keys[key_id]

request = requests.Request('POST', 'https://example.com/foo?param=Value&Pet=dog', json={"hello": "world"})
request = request.prepare()
request.headers["Content-Digest"] = str(http_sfv.Dictionary({"sha-256": hashlib.sha256(request.body).digest()}))

signer = HTTPMessageSigner(signature_algorithm=algorithms.HMAC_SHA256, key_resolver=MyHTTPSignatureKeyResolver())
signer.sign(request, key_id="my-key", covered_component_ids=("@method", "@authority", "@target-uri", "content-digest"))

verifier = HTTPMessageVerifier(signature_algorithm=algorithms.HMAC_SHA256, key_resolver=MyHTTPSignatureKeyResolver())
verifier.verify(request)

Note that verifying the body content-digest is outside the scope of this package’s functionality, so it remains the caller’s responsibility. The requests-http-signature library builds upon this package to provide integrated signing and validation of the request body.

See what is signed

It is important to understand and follow the best practice rule of “See what is signed” when verifying HTTP message signatures. The gist of this rule is: if your application neglects to verify that the information it trusts is what was actually signed, the attacker can supply a valid signature but point you to malicious data that wasn’t signed by that signature. Failure to follow this rule can lead to vulnerability against signature wrapping and substitution attacks.

In http-message-signatures, you can ensure that the information signed is what you expect to be signed by only trusting the data returned by the verify() method:

verify_result = verifier.verify(request)

This returns VerifyResult, a namedtuple with the following attributes:

label (str): The label for the signature
algorithm: (same as signature_algorithm above)
covered_components: A mapping of component names to their values, as covered by the signature
parameters: A mapping of signature parameters to their values, as covered by the signature
body: Always None (the requests-http-signature package implements returning the body upon successful digest validation).

Authors

Andrey Kislyuk

License

Licensed under the terms of the Apache License, Version 2.0.

Metadata

Release files for http-message-signatures 0.4.2

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for http-message-signatures 0.4.2
File	Size	Uploaded	Provenance
http-message-signatures-0.4.2.tar.gz	23.8 kB	Apr 19, 2022	Without provenance	Details

Built distribution (wheel)

Table of built distributions (wheels) for http-message-signatures 0.4.2
File	Interpreter	ABI	Platform	Reset
http_message_signatures-0.4.2-py3-none-any.whl 14.3 kB Apr 19, 2022 Without provenance	Python 3	none	any	Details

Total release size: 38.1 kB

Release files / http-message-signatures-0.4.2.tar.gz

Download URL	http-message-signatures-0.4.2.tar.gz
Size	23.8 kB
Tags	Source
SHA-256 checksum How to use checksums	`84c40b40fa16b55e915f17c011ae25732d6b044841e8dd870e83517dcbcd74d0`
BLAKE2b-256 checksum How to use checksums	`b0993367c9aeb231f0966d6c0daed8db0cc01cada0cec38a251a180f40214e48`
Upload date	Apr 19, 2022
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/3.4.1 importlib_metadata/4.6.0 pkginfo/1.7.0 requests/2.25.1 requests-toolbelt/0.9.1 tqdm/4.61.1 CPython/3.9.10`

Release files / http_message_signatures-0.4.2-py3-none-any.whl

Download URL	http_message_signatures-0.4.2-py3-none-any.whl
Size	14.3 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`ab39cf27cb8a2378a2da4b002046b15249885e894a557bd38ff0858ca2a682e2`
BLAKE2b-256 checksum How to use checksums	`483b8842f346b19a908088505382f44762a7d37ddb6e4edc1aadcd52d64dd002`
Upload date	Apr 19, 2022
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/3.4.1 importlib_metadata/4.6.0 pkginfo/1.7.0 requests/2.25.1 requests-toolbelt/0.9.1 tqdm/4.61.1 CPython/3.9.10`

Security for http-message-signatures 0.4.2

Report project as malware

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.