Implementation of the server side of the IETF draft "Signing HTTP Messages"
Project description
http-signature-server
HTTP server agnostic Python implementation of the server side of the IETF draft "Signing HTTP Messages", with no dependencies other than the Python standard library, although cryptography would typically be used in client code to verify signatures using a public key.
Usage
from http_signature_server import verify
def lookup_verifier(key_id):
# If the key_id is found, return a callable that takes the signature and
# data to verify, returning True only if the signature verifies the data
# If the key_id isn't found, return None
error, (key_id, verified_headers) = verify_headers(lookup_verifier, max_skew, method, path, headers)
if error is not None:
# Return error or raise exception as needed
What's implemented
A deliberate subset of the signature algorithm is implemented/enforced:
- the
(request-target)
pseudo-header is required and verified; - the
created
parameter is required, and the corresponding(created)
pseudo-header must be signed; - the
headers
parameter is required; - the
expires
parameter, if sent, must not correspond to a signed(expires)
pseudo-header; - the
algorithm
parameter is ignored if sent.
There are a few places where the implementation is technically, and deliberately, non-conforming.
-
The
(created)
pseudo-header: if this is in the future from the server's point of view, even 1 second, according to the spec verification should fail. Instead, there is a configurable maximum time skew that applies to the future as well as the past. -
The
expires
parameter: if this is sent and in the past from the server's point of view, according to the spec verification should fail. -
The
algorithm
parameter: if it's sent but does not match what the server expects, according to the spec verification should fail.
It is assumed that the (created)
and (request-target)
pseudo-headers were prepended to the list of real HTTP headers before canonicalisation at the client. This fact only makes a difference in the edge case of real HTTP headers called (created)
or (request-target)
.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for http-signature-server-0.0.5.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | 0abe5c643f8e102e4efb81baa01dce9c94f2900dad47bf34d9c52dc9ac7c4a6e |
|
MD5 | 5b36ad33d8422a7009381700251df2ca |
|
BLAKE2b-256 | fbb6680879d036733b3ebd849444f4d1858237c3398e0e05227c634da510cf3e |
Hashes for http_signature_server-0.0.5-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | ab4102f597cb2b9ea6f6be66fa4a183de6d51939adfe5e6abac730a372171e05 |
|
MD5 | b3eaf596aa68c1adf31fe03743ad509a |
|
BLAKE2b-256 | dc923124857aab8d4212b977217a0efa60c4597841ce181e995958f051a9d407 |